Advisoriesby IbisAgent Network Filter Security Feature Bypass
Impact
A security feature bypass vulnerability existed in VS Code builds up to and including version 1.136.1 when agent network filtering used dotted IPv4 literals in a deny list. An equivalent IPv4-mapped IPv6 literal normalized to a different string and did not match the configured IPv4 entry. In a deny-only configuration, the unmatched destination was allowed. An attacker able to influence a URL accessed by an agent network tool could use an alternate address representation to reach an endpoint that an administrator intended to block.
The affected configuration required chat.agent.networkFilter to be enabled, at least one IPv4 literal in chat.agent.deniedNetworkDomains, and an empty chat.agent.allowedNetworkDomains list.
Patches
The fix (https://github.com/microsoft/vscode/commit/8a19bab00bd06be92dbdcf470d24e369496ae1d1) is is available in VS Code builds starting with 1.136.2. The fix compares dotted IPv4 addresses with equivalent IPv4-mapped and IPv4-compatible IPv6 literals using a shared IPv4 representation, including for wildcard-prefixed IPv4 patterns, while preserving distinct IPv6 unspecified and loopback addresses. Regression tests cover alternate mapped spellings, deny-only policy behavior, and blocked requests before web content extraction.
Workarounds
Use an explicit, non-empty chat.agent.allowedNetworkDomains allow list instead of...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.136.2 | 1.136.2 |
Details and references
### Impact A security feature bypass vulnerability existed in VS Code builds up to and including version 1.136.1 when agent network filtering used dotted IPv4 literals in a deny list. An equivalent IPv4-mapped IPv6 literal normalized to a different string and did not match the configured IPv4 entry. In a deny-only configuration, the unmatched destination was allowed. An attacker able to influence a URL accessed by an agent network tool could use an alternate address representation to reach an endpoint that an administrator intended to block. The affected configuration required `chat.agent.networkFilter` to be enabled, at least one IPv4 literal in `chat.agent.deniedNetworkDomains`, and an empty `chat.agent.allowedNetworkDomains` list. ### Patches The fix (https://github.com/microsoft/vscode/commit/8a19bab00bd06be92dbdcf470d24e369496ae1d1) is is available in VS Code builds starting with **1.136.2**. The fix compares dotted IPv4 addresses with equivalent IPv4-mapped and IPv4-compatible IPv6 literals using a shared IPv4 representation, including for wildcard-prefixed IPv4 patterns, while preserving distinct IPv6 unspecified and loopback addresses. Regression tests cover alternate mapped spellings, deny-only policy behavior, and blocked requests before web content extraction. ### Workarounds Use an explicit, non-empty `chat.agent.allowedNetworkDomains` allow list instead of relying on a deny-only configuration. Alternatively, disable agent tools that can access network resources until a build containing the fix is installed. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/8a19bab00bd06be92dbdcf470d24e369496ae1d1 * An issue this can be found at https://github.com/microsoft/vscode/issues/335127 * MSRC details for CVE-2026-81357 can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81357
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
- Severity from
- GitHub (reviewed advisory)