Fileless RCE in VS Code Web Remote Terminal via URL-Controlled NODE_OPTIONS

## VS Code - Remote Code Execution Vulnerability A remote code execution vulnerability exists in VS Code 1.132.0 and earlier versions when an attacker can achieve remote code execution by luring a code-server user to a crafted link that silently alters their VS Code session, causing the next routine Node.js command run in the terminal to execute attacker-controlled code. ### Patches The fix is targeted for the next VS Code 1.132 recovery release. The fix (https://github.com/devdiv-microsoft/vscode-private/pull/78) mitigates this attack by rejecting privileged extension development options from URL payloads in production builds, sanitizing untrusted remote terminal environment values, and preventing client-provided values from overriding extension host bootstrap variables. ### Workarounds Do not open VS Code web URLs that originate from an untrusted source. Administrators should restrict access to trusted VS Code web deployments until the update is installed. ### References * The patch for this can be found at https://github.com/devdiv-microsoft/vscode-private/pull/78 * MSRC details for CVE-2026-70336 can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70336 * MSRC incident details for case 130515 can be found at https://portal.microsofticm.com/imp/v5/incidents/details/31000000673117 Msrc-Case-Id: 130515 (CVE 2026-70336)

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity from

GitHub (reviewed advisory)

• github.com/microsoft/vscode/security/advisories/GHSA-fp6w-v29h-43rj
• github.com/microsoft/vscode