Visual Studio Code web deployments - environmentService.ts - RCE via NODE_OPTIONS --import from URL payload

## VS Code - Remote Code Execution Vulnerability A remote code execution vulnerability exists in VS Code 1.132.0 and earlier versions when a user opens a maliciously crafted VS Code web URL. The URL can supply privileged workbench payload values that flow into remote extension host and integrated terminal startup. In the terminal path, an attacker-controlled `NODE_OPTIONS` value can execute code when the victim later runs a Node-based command. ### Patches The fix is targeted for the next VS Code 1.132 recovery release. The fix (https://github.com/devdiv-microsoft/vscode-private/pull/78) mitigates this attack by rejecting privileged extension development options from URL payloads in production builds, sanitizing untrusted remote terminal environment values, and preventing client-provided values from overriding extension host bootstrap variables. ### Workarounds Do not open VS Code web URLs that originate from an untrusted source. Administrators should restrict access to trusted VS Code web deployments until the update is installed. ### References * The patch for this can be found at https://github.com/devdiv-microsoft/vscode-private/pull/78 * MSRC details for CVE-2026-69320 can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69320 * MSRC incident details for case 113839 can be found at https://portal.microsofticm.com/imp/v5/incidents/details/31000000588604/ Msrc-Case-Id: 113839 (CVE-2026-69320)

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity from

GitHub (reviewed advisory)

• github.com/microsoft/vscode/security/advisories/GHSA-h29r-p8vr-4vfm
• github.com/microsoft/vscode