Workspace Trust Security Feature Bypass Vulnerability

HighCVE-2026-57101 · Published Jul 14, 2026

A security feature bypass vulnerability exists in VS Code 1.128.0 and earlier versions where, under certain conditions, specially crafted notebook content could bypass security restrictions in Restricted Mode. ### Patches The fix is available starting with **VS Code 1.128.1**. The fix mitigates this attack by improving how untrusted notebook content is handled. ### Workarounds Do not open notebooks from untrusted sources on versions of VS Code <=1.128.0. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/bc2d56c6f8da22a4bd31f741fcb034208770f158 * An issue for this can be found at https://github.com/microsoft/vscode/issues/325839 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57101