Workspace Trust Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in VS Code 1.128.0 and earlier versions where, under certain conditions, specially crafted notebook content could bypass security restrictions in Restricted Mode.

Patches

The fix is available starting with VS Code 1.128.1. The fix mitigates this attack by improving how untrusted notebook content is handled.

Workarounds

Do not open notebooks from untrusted sources on versions of VS Code <=1.128.0.

References

• The patch for this can be found at https://github.com/microsoft/vscode/commit/bc2d56c6f8da22a4bd31f741fcb034208770f158
• An issue for this can be found at https://github.com/microsoft/vscode/issues/325839
• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57101