Advisoriesby IbisAuto-Approved File Write via Unconfirmed Environment-Variable Path Redirection
VS Code - Security Feature Bypass Vulnerability
A security feature bypass vulnerability exists in VS Code where the terminal command auto-approval logic could approve a file-write redirection to a path that escapes the expected workspace scope. The guard that blocks redirection to non-absolute destinations accounted for POSIX tilde/home expansion (~) but not Windows environment-variable expansion (%). Paths such as %APPDATA%\file.txt or %HOME%/file.txt are not classified as absolute by posix.isAbsolute or win32.isAbsolute, so a command redirecting output to one of them could be auto-approved and write to a sensitive, user-controlled location without explicit user confirmation.
Patches
The fix extends the redirection guard to also block auto-approval when the destination path contains % (Windows environment-variable expansion), in addition to the existing ~ handling, and adds regression tests for both bash and pwsh.
Workarounds
Avoid enabling terminal command auto-approval, or set chat.tools.terminal.autoApprove / the file-write blocking setting so that detected file writes are always blocked.
References
- The patch for this can be found at https://github.com/microsoft/vscode/pull/320676
- An issue for this can be found at [#320660](https://github.com/microsoft/vscode/issues/320660)
- MSRC details for this can be found at...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.123.1 | 1.123.1 |
Details and references
## VS Code - Security Feature Bypass Vulnerability A security feature bypass vulnerability exists in VS Code where the terminal command auto-approval logic could approve a file-write redirection to a path that escapes the expected workspace scope. The guard that blocks redirection to non-absolute destinations accounted for POSIX tilde/home expansion (`~`) but not Windows environment-variable expansion (`%`). Paths such as `%APPDATA%\file.txt` or `%HOME%/file.txt` are not classified as absolute by `posix.isAbsolute` or `win32.isAbsolute`, so a command redirecting output to one of them could be auto-approved and write to a sensitive, user-controlled location without explicit user confirmation. ### Patches The fix extends the redirection guard to also block auto-approval when the destination path contains `%` (Windows environment-variable expansion), in addition to the existing `~` handling, and adds regression tests for both bash and pwsh. ### Workarounds Avoid enabling terminal command auto-approval, or set `chat.tools.terminal.autoApprove` / the file-write blocking setting so that detected file writes are always blocked. ### References - The patch for this can be found at https://github.com/microsoft/vscode/pull/320676 - An issue for this can be found at [#320660](https://github.com/microsoft/vscode/issues/320660) - MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45482
- Severity from
- GitHub (reviewed advisory)