Agent Network Filter Security Feature Bypass

### Impact A security feature bypass vulnerability existed in VS Code builds up to and including version 1.136.1 when agent network filtering used dotted IPv4 literals in a deny list. An equivalent IPv4-mapped IPv6 literal normalized to a different string and did not match the configured IPv4 entry. In a deny-only configuration, the unmatched destination was allowed. An attacker able to influence a URL accessed by an agent network tool could use an alternate address representation to reach an endpoint that an administrator intended to block. The affected configuration required `chat.agent.networkFilter` to be enabled, at least one IPv4 literal in `chat.agent.deniedNetworkDomains`, and an empty `chat.agent.allowedNetworkDomains` list. ### Patches The fix (https://github.com/microsoft/vscode/commit/8a19bab00bd06be92dbdcf470d24e369496ae1d1) is is available in VS Code builds starting with **1.136.2**. The fix compares dotted IPv4 addresses with equivalent IPv4-mapped and IPv4-compatible IPv6 literals using a shared IPv4 representation, including for wildcard-prefixed IPv4 patterns, while preserving distinct IPv6 unspecified and loopback addresses. Regression tests cover alternate mapped spellings, deny-only policy behavior, and blocked requests before web content extraction. ### Workarounds Use an explicit, non-empty `chat.agent.allowedNetworkDomains` allow list instead of relying on a deny-only configuration. Alternatively, disable agent tools that can access network resources until a build containing the fix is installed. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/8a19bab00bd06be92dbdcf470d24e369496ae1d1 * An issue this can be found at https://github.com/microsoft/vscode/issues/335127 * MSRC details for CVE-2026-81357 can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81357

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Severity from

GitHub (reviewed advisory)

• github.com/microsoft/vscode/security/advisories/GHSA-4xcg-6mm5-hj26
• github.com/microsoft/vscode