TerminalInstance._createProcess - Workspace Trust bypass via terminal waitOnExit
High7.8CVE-2026-69278 · Published Aug 11, 2026
## VS Code - Terminal Workspace Trust Bypass Vulnerability A command execution vulnerability exists in VS Code 1.132.0 and earlier versions where terminal process creation can continue after workspace trust is denied or dismissed. Terminal process creation can also continue in an empty workspace after VS Code detects an unexpected working directory. An attacker could exploit these issues by convincing a user to open a malicious workspace in VS Code. ### Patches The fix will be available starting with **VS Code 1.132.1**. The fix (https://github.com/microsoft/vscode/commit/3154a68fc151bcafe371f89d197412645e6a7616) mitigates these issues by stopping terminal process creation immediately when either security check rejects the launch. ### Workarounds Do not open untrusted workspaces. If an untrusted workspace is already open, do not launch an integrated terminal. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/3154a68fc151bcafe371f89d197412645e6a7616 * MSRC incident details can be found at https://portal.microsofticm.com/imp/v5/incidents/details/31000000607658/summary * MSRC details for these issues can be found at https://msrc.mic...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.132.1 | 1.132.1 |
Details and references
## VS Code - Terminal Workspace Trust Bypass Vulnerability A command execution vulnerability exists in VS Code 1.132.0 and earlier versions where terminal process creation can continue after workspace trust is denied or dismissed. Terminal process creation can also continue in an empty workspace after VS Code detects an unexpected working directory. An attacker could exploit these issues by convincing a user to open a malicious workspace in VS Code. ### Patches The fix will be available starting with **VS Code 1.132.1**. The fix (https://github.com/microsoft/vscode/commit/3154a68fc151bcafe371f89d197412645e6a7616) mitigates these issues by stopping terminal process creation immediately when either security check rejects the launch. ### Workarounds Do not open untrusted workspaces. If an untrusted workspace is already open, do not launch an integrated terminal. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/3154a68fc151bcafe371f89d197412645e6a7616 * MSRC incident details can be found at https://portal.microsofticm.com/imp/v5/incidents/details/31000000607658/summary * MSRC details for these issues can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69278
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 11 | Copilot Chat Security Feature Bypass Vulnerability | High7.1 | 1.132.1 |
| Aug 11 | Copilot Custom Agent Hook Remote Code Execution Vulnerability | High7.8 | 1.132.1 |
| Aug 11 | Information disclosure vulnerability | Medium | 1.132.1 |
| Aug 11 | Fileless RCE in VS Code Web Remote Terminal via URL-Controlled NODE_OPTIONS | High8.8 | 1.132.1 |
| Aug 11 | Visual Studio Code web deployments - environmentService.ts - RCE via NODE_OPTIONS --import from URL payload | High8.8 | 1.132.1 |
| Aug 11 | TerminalInstance._createProcess() - Local RCE via extensions.json recommendation link | High7.8 | 1.132.1 |