Agent Network Filter Bypass Vulnerability

### Impact A security feature bypass exists in VS Code builds up to and including version 1.136.1 when Agent mode uses Fetch Web Page or integrated browser tools with the agent network filter enabled. Differences in URL authority parsing could allow a specially crafted URL to bypass `chat.agent.deniedNetworkDomains`. Separately, some valid administrator patterns, including IP literals, IPv6 addresses, internal host names, and domains outside a fixed suffix list, could be ignored. An attacker able to influence an agent through direct instructions or indirect prompt injection could cause requests to hosts that an administrator intended to block. This could expose workspace or agent-context data to an unauthorized host or allow access to local and link-local services. ### Patches The fix (https://github.com/microsoft/vscode/commit/d804f2b57392655df446901dd9bdab2685ed5ad4) interprets URL authorities consistently with the request URL parser, rejects ambiguous or malformed network authorities, fails closed for HTTP, HTTPS, WebSocket, and secure WebSocket requests, and honors syntactically valid administrator domain patterns. ### Workarounds Until the update is installed, disable Fetch Web Page and integrated browser tools for Agent mode, or avoid using Agent mode with sensitive workspaces and untrusted content. Do not rely on denied-domain policy as the only network boundary in an affected version. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/d804f2b57392655df446901dd9bdab2685ed5ad4 * An issue for this can be found at https://github.com/microsoft/vscode/issues/335122 * MSRC details for CVE-2026-81379 can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81379

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Severity from

GitHub (reviewed advisory)

• github.com/microsoft/vscode/security/advisories/GHSA-hr37-8jwr-q8p8
• github.com/microsoft/vscode