Agent network filter bypass via IPv4-mapped IPv6 literals
High8.2CVE-2026-69306 · Published Aug 12, 2026
### Impact A security feature bypass vulnerability exists in VS Code 1.132.0 and earlier versions when the agent network filter is enabled. The URL authority matcher did not handle bracketed IPv6 literals and treated normalization failures as allowed. An attacker who can influence agent instructions or tool arguments could use an IPv4-mapped IPv6 URL to cause the built-in Fetch Page or Integrated Browser tools to access local HTTP services despite deny-all or allowlist network policies. ### Patches The fix is available starting with VS Code 1.132.1. The fix (https://github.com/microsoft/vscode/pull/330308/changes/0c5eba4dbd5585234b632e438f9afedc063415a3) mitigates this attack by by parsing URL authorities with URL-aware normalization, canonicalizing bracketed IPv6 addresses, and failing closed when HTTP(S) authorities cannot be normalized.. ### Workarounds If upgrading is not immediately possible: 1. In the chat tool picker, disable **Fetch Web Page** and all **Browser** tools, including **Open Browser Page**. 2. Disable agent access to Integrated Browser pages: ```json "workbench.browser.enableChatTools": false ``` ### References The patch for this can be found at https://git...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.132.1 | 1.132.1 |
Details and references
### Impact A security feature bypass vulnerability exists in VS Code 1.132.0 and earlier versions when the agent network filter is enabled. The URL authority matcher did not handle bracketed IPv6 literals and treated normalization failures as allowed. An attacker who can influence agent instructions or tool arguments could use an IPv4-mapped IPv6 URL to cause the built-in Fetch Page or Integrated Browser tools to access local HTTP services despite deny-all or allowlist network policies. ### Patches The fix is available starting with VS Code 1.132.1. The fix (https://github.com/microsoft/vscode/pull/330308/changes/0c5eba4dbd5585234b632e438f9afedc063415a3) mitigates this attack by by parsing URL authorities with URL-aware normalization, canonicalizing bracketed IPv6 addresses, and failing closed when HTTP(S) authorities cannot be normalized.. ### Workarounds If upgrading is not immediately possible: 1. In the chat tool picker, disable **Fetch Web Page** and all **Browser** tools, including **Open Browser Page**. 2. Disable agent access to Integrated Browser pages: ```json "workbench.browser.enableChatTools": false ``` ### References The patch for this can be found at https://github.com/microsoft/vscode/pull/330308/changes/0c5eba4dbd5585234b632e438f9afedc063415a3 An issue for this can be found at https://github.com/microsoft/vscode/issues/330324 MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69306
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-636
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 12 | Fetch Web Page OS protocol handler remote code execution | High8.8 | 1.132.1 |
| Aug 11 | Copilot Chat Security Feature Bypass Vulnerability | High7.1 | 1.132.1 |
| Aug 11 | Copilot Custom Agent Hook Remote Code Execution Vulnerability | High7.8 | 1.132.1 |
| Aug 11 | Information disclosure vulnerability | Medium | 1.132.1 |
| Aug 11 | Fileless RCE in VS Code Web Remote Terminal via URL-Controlled NODE_OPTIONS | High8.8 | 1.132.1 |
| Aug 11 | Visual Studio Code web deployments - environmentService.ts - RCE via NODE_OPTIONS --import from URL payload | High8.8 | 1.132.1 |