Advisoriesby IbisTrusted URL Validation Security Feature Bypass
Impact
A security feature bypass vulnerability existed in affected VS Code builds up to and including version 1.136.1, when trusted URL validation processed percent-encoded user information. URL normalization could classify the user-information prefix as trusted while the browser or web content loader dereferenced a different host. An attacker who could influence a URL opened from content or processed by Fetch Web Page could suppress expected request or response confirmation, potentially enabling server-side request forgery against internal network destinations or disclosure of fetched content.
Patches
The fix (https://github.com/microsoft/vscode/commit/e5c58adb0bafaff3e2265e7d1153139f1b784f61) is available in VS Code builds starting with 1.136.2. The fix rejects URLs containing user information, and authorityless HTTP(S) inputs that could gain an authority during slash/backslash normalization, from implicit, exact, and subdomain-wildcard trusted-domain matching. It also prevents persistent approval patterns from being generated for these URLs while preserving explicit * trust-all behavior.
Workarounds
Do not activate or fetch URLs from untrusted repository or document content until a build containing the fix is installed. Remove URL rules from chat.tools.urls.autoApprove if Fetch Web Page may process untrusted URLs.
References
- The patch for...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.136.2 | 1.136.2 |
Details and references
### Impact A security feature bypass vulnerability existed in affected VS Code builds up to and including version 1.136.1, when trusted URL validation processed percent-encoded user information. URL normalization could classify the user-information prefix as trusted while the browser or web content loader dereferenced a different host. An attacker who could influence a URL opened from content or processed by Fetch Web Page could suppress expected request or response confirmation, potentially enabling server-side request forgery against internal network destinations or disclosure of fetched content. ### Patches The fix (https://github.com/microsoft/vscode/commit/e5c58adb0bafaff3e2265e7d1153139f1b784f61) is available in VS Code builds starting with **1.136.2**. The fix rejects URLs containing user information, and authorityless HTTP(S) inputs that could gain an authority during slash/backslash normalization, from implicit, exact, and subdomain-wildcard trusted-domain matching. It also prevents persistent approval patterns from being generated for these URLs while preserving explicit `*` trust-all behavior. ### Workarounds Do not activate or fetch URLs from untrusted repository or document content until a build containing the fix is installed. Remove URL rules from `chat.tools.urls.autoApprove` if Fetch Web Page may process untrusted URLs. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/e5c58adb0bafaff3e2265e7d1153139f1b784f61 * An issue for this can be found at https://github.com/microsoft/vscode/issues/335116 * MSRC details for CVE-2026-81356 can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81356
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
- Severity from
- GitHub (reviewed advisory)