Advisoriesby IbisAgent network filter bypass via IPv4-mapped IPv6 literals
Impact
A security feature bypass vulnerability exists in VS Code 1.132.0 and earlier versions when the agent network filter is enabled. The URL authority matcher did not handle bracketed IPv6 literals and treated normalization failures as allowed. An attacker who can influence agent instructions or tool arguments could use an IPv4-mapped IPv6 URL to cause the built-in Fetch Page or Integrated Browser tools to access local HTTP services despite deny-all or allowlist network policies.
Patches
The fix is available starting with VS Code 1.132.1. The fix (https://github.com/microsoft/vscode/pull/330308/changes/0c5eba4dbd5585234b632e438f9afedc063415a3) mitigates this attack by by parsing URL authorities with URL-aware normalization, canonicalizing bracketed IPv6 addresses, and failing closed when HTTP(S) authorities cannot be normalized..
Workarounds
If upgrading is not immediately possible:
1. In the chat tool picker, disable Fetch Web Page and all Browser tools, including Open Browser Page.
2. Disable agent access to Integrated Browser pages:
```json
"workbench.browser.enableChatTools": false
`
References
The patch for this can be found at https://github.com/microsoft/vscode/pull/330308/changes/0c5eba4dbd5585234b632e438f9afedc063415a3
An issue for this can be found at https://github.com/microsoft/vscode/issues/330324
MSRC details for this can be...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.132.1 | 1.132.1 |
Details and references
### Impact A security feature bypass vulnerability exists in VS Code 1.132.0 and earlier versions when the agent network filter is enabled. The URL authority matcher did not handle bracketed IPv6 literals and treated normalization failures as allowed. An attacker who can influence agent instructions or tool arguments could use an IPv4-mapped IPv6 URL to cause the built-in Fetch Page or Integrated Browser tools to access local HTTP services despite deny-all or allowlist network policies. ### Patches The fix is available starting with VS Code 1.132.1. The fix (https://github.com/microsoft/vscode/pull/330308/changes/0c5eba4dbd5585234b632e438f9afedc063415a3) mitigates this attack by by parsing URL authorities with URL-aware normalization, canonicalizing bracketed IPv6 addresses, and failing closed when HTTP(S) authorities cannot be normalized.. ### Workarounds If upgrading is not immediately possible: 1. In the chat tool picker, disable **Fetch Web Page** and all **Browser** tools, including **Open Browser Page**. 2. Disable agent access to Integrated Browser pages: ```json "workbench.browser.enableChatTools": false ``` ### References The patch for this can be found at https://github.com/microsoft/vscode/pull/330308/changes/0c5eba4dbd5585234b632e438f9afedc063415a3 An issue for this can be found at https://github.com/microsoft/vscode/issues/330324 MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69306
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-636