Unconfirmed Remote Host Connection via Workspace File

VS Code - Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in VS Code 1.123.0 and earlier versions where a user who is tricked into opening a crafted .code-workspace file containing a direct host:port remote authority could have their extension host backend silently connected to an attacker-controlled server without confirmation.

Patches

The fix is available starting with VS Code 1.123.1. The fix ([9505d0f](https://github.com/microsoft/vscode/commit/9505d0fca49eadb707c450d18dcb41a46b720a9e)) mitigates this by prompting the user for confirmation before connecting to any non-loopback remote host:port authority.

Workarounds

Avoid opening .code-workspace files from untrusted sources.

References

• The patch for this can be found at [9505d0f](https://github.com/microsoft/vscode/commit/9505d0fca49eadb707c450d18dcb41a46b720a9e)
• An issue for this can be found at [#320645](https://github.com/microsoft/vscode/issues/320645)
• MSRC details for this can be found at [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47281](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47281)