Advisoriesby IbisMicrosoftGHSA-3pwg-f3hj-wp8p
Terminal auto replies restriction
Fix: upgrade to 1.109.1 or later
VS Code Terminal Auto Replies Configuration Cross-Workspace Code Execution
A vulnerability exists in VS Code 1.109 and earlier versions where terminal.integrated.autoReplies can cause commands to be repeatedly auto-executed in previously trusted folders, and the behavior persists across folders until a completely new window is opened.
Patches
The fix is available with VS Code 1.109.1. It marks terminal.integrated.autoReplies as restricted: true, which prevents this behavior from happening.
Workarounds
Do not reuse the window to open folders with automatic tasks. Instead, open a new window.
References
- The patch for this can be found at https://github.com/microsoft/vscode/commit/670c6d9b2a6588cc90a1e347015966dc391795ba
- MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.109.1 | 1.109.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)