Advisoriesby IbisVisual Studio Code MCP gallery metadata path traversal
Impact
A path traversal vulnerability in Visual Studio Code's Model Context Protocol (MCP) server management could allow attacker-controlled gallery or registry metadata to redirect file operations outside the intended per-server storage location.
Visual Studio Code used an MCP server's name and version to construct its metadata directory without sufficiently validating the resulting path. Installing or updating a server with malicious metadata could overwrite another installed server's manifest.json or README.md, or write files outside the MCP storage directory.
Uninstalling an affected server entry could also cause an unintended directory to be recursively deleted.
Exploitation requires user interaction, such as installing or updating an MCP server whose gallery or registry metadata is controlled by an attacker.
Patches
The fix is available starting with Visual Studio Code 1.136.2.
The fix ([6a88486](https://github.com/microsoft/vscode/commit/6a88486bf4f0033dfc5c7ff1e305d34ed200aed4)) validates that the resolved metadata path represents a single directory component within the MCP storage directory. It also verifies that an uninstall target matches the location derived from that specific server's name and version before allowing deletion.
Users should update to Visual Studio Code 1.136.2 or later.
Workarounds
Do not install or update MCP servers...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Visual Studio Code Product | >= 1.0.0, < 1.136.2 | 1.136.2 |
Details and references
## Impact A path traversal vulnerability in Visual Studio Code's Model Context Protocol (MCP) server management could allow attacker-controlled gallery or registry metadata to redirect file operations outside the intended per-server storage location. Visual Studio Code used an MCP server's name and version to construct its metadata directory without sufficiently validating the resulting path. Installing or updating a server with malicious metadata could overwrite another installed server's `manifest.json` or `README.md`, or write files outside the MCP storage directory. Uninstalling an affected server entry could also cause an unintended directory to be recursively deleted. Exploitation requires user interaction, such as installing or updating an MCP server whose gallery or registry metadata is controlled by an attacker. ## Patches The fix is available starting with **Visual Studio Code 1.136.2**. The fix ([6a88486](https://github.com/microsoft/vscode/commit/6a88486bf4f0033dfc5c7ff1e305d34ed200aed4)) validates that the resolved metadata path represents a single directory component within the MCP storage directory. It also verifies that an uninstall target matches the location derived from that specific server's name and version before allowing deletion. Users should update to Visual Studio Code 1.136.2 or later. ## Workarounds Do not install or update MCP servers from untrusted galleries or registries. Avoid servers whose publisher or registry source cannot be trusted. These precautions reduce exposure but are not a substitute for updating Visual Studio Code. ## References - [Visual Studio Code issue #335114](https://github.com/microsoft/vscode/issues/335114) - [Fix commit 6a88486](https://github.com/microsoft/vscode/commit/6a88486bf4f0033dfc5c7ff1e305d34ed200aed4) - [MSRC entry for CVE-2026-81377](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81377) - [CVE record for CVE-2026-81377](https://www.cve.org/CVERecord?id=CVE-2026-81377)
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22