Unconfirmed Remote Host Connection via Workspace File

HighCVE-2026-47281 · Published Jun 9, 2026

## VS Code - Elevation of Privilege Vulnerability An elevation of privilege vulnerability exists in VS Code 1.123.0 and earlier versions where a user who is tricked into opening a crafted `.code-workspace` file containing a direct `host:port` remote authority could have their extension host backend silently connected to an attacker-controlled server without confirmation. ### Patches The fix is available starting with **VS Code 1.123.1**. The fix ([9505d0f](https://github.com/microsoft/vscode/commit/9505d0fca49eadb707c450d18dcb41a46b720a9e)) mitigates this by prompting the user for confirmation before connecting to any non-loopback remote `host:port` authority. ### Workarounds Avoid opening `.code-workspace` files from untrusted sources. ### References - The patch for this can be found at [9505d0f](https://github.com/microsoft/vscode/commit/9505d0fca49eadb707c450d18dcb41a46b720a9e) - An issue for this can be found at [#320645](https://github.com/microsoft/vscode/issues/320645) - MSRC details for this can be found at [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47281](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47281)