Trusted URL Validation Security Feature Bypass

### Impact A security feature bypass vulnerability existed in affected VS Code builds up to and including version 1.136.1, when trusted URL validation processed percent-encoded user information. URL normalization could classify the user-information prefix as trusted while the browser or web content loader dereferenced a different host. An attacker who could influence a URL opened from content or processed by Fetch Web Page could suppress expected request or response confirmation, potentially enabling server-side request forgery against internal network destinations or disclosure of fetched content. ### Patches The fix (https://github.com/microsoft/vscode/commit/e5c58adb0bafaff3e2265e7d1153139f1b784f61) is available in VS Code builds starting with **1.136.2**. The fix rejects URLs containing user information, and authorityless HTTP(S) inputs that could gain an authority during slash/backslash normalization, from implicit, exact, and subdomain-wildcard trusted-domain matching. It also prevents persistent approval patterns from being generated for these URLs while preserving explicit `*` trust-all behavior. ### Workarounds Do not activate or fetch URLs from untrusted repository or document content until a build containing the fix is installed. Remove URL rules from `chat.tools.urls.autoApprove` if Fetch Web Page may process untrusted URLs. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/e5c58adb0bafaff3e2265e7d1153139f1b784f61 * An issue for this can be found at https://github.com/microsoft/vscode/issues/335116 * MSRC details for CVE-2026-81356 can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81356

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Severity from

GitHub (reviewed advisory)

• github.com/microsoft/vscode/security/advisories/GHSA-2mjm-fqwf-jq98
• github.com/microsoft/vscode