Fileless RCE in VS Code Web Remote Terminal via URL-Controlled NODE_OPTIONS

VS Code - Remote Code Execution Vulnerability

A remote code execution vulnerability exists in VS Code 1.132.0 and earlier versions when an attacker can achieve remote code execution by luring a code-server user to a crafted link that silently alters their VS Code session, causing the next routine Node.js command run in the terminal to execute attacker-controlled code.

Patches

The fix is targeted for the next VS Code 1.132 recovery release. The fix (https://github.com/devdiv-microsoft/vscode-private/pull/78) mitigates this attack by rejecting privileged extension development options from URL payloads in production builds, sanitizing untrusted remote terminal environment values, and preventing client-provided values from overriding extension host bootstrap variables.

Workarounds

Do not open VS Code web URLs that originate from an untrusted source. Administrators should restrict access to trusted VS Code web deployments until the update is installed.

References

• The patch for this can be found at https://github.com/devdiv-microsoft/vscode-private/pull/78
• MSRC details for CVE-2026-70336 can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70336
• MSRC incident details for case 130515 can be found at https://portal.microsofticm.com/imp/v5/incidents/details/31000000673117

Msrc-Case-Id: 130515 (CVE 2026-70336)