Visual Studio Code Workspace Trust bypass through attacker-controlled services
Critical9.6CVE-2026-81376 · Published Sep 8, 2026
## Impact A security feature bypass vulnerability exists in Visual Studio Code 1.136.1 and earlier versions. An attacker could convince a user to open a specially crafted Visual Studio Code workspace that causes Visual Studio Code to connect to an attacker-controlled service while the workspace is open in Restricted Mode. Due to incomplete enforcement of Workspace Trust restrictions, the crafted workspace could bypass protections intended to prevent content in untrusted workspaces from running commands or code. Successful exploitation could allow an attacker to access local data or execute code in the context of the user. User interaction is required because the user must open the crafted workspace. However, the user does not need to grant trust to the workspace for exploitation to occur. ## Patches The fix is available starting with **Visual Studio Code 1.136.2**. The fix ([0684cb5](https://github.com/microsoft/vscode/commit/0684cb5905a3f23156f45a28135326e09310ff4d)) ensures that restricted workspace settings are correctly identified and filtered when processing nested configuration objects. Users should update to Visual Studio Code 1.136.2 or later. ## Workarounds Do not...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Visual Studio Code Product | < 1.136.2 | 1.136.2 |
Details and references
## Impact A security feature bypass vulnerability exists in Visual Studio Code 1.136.1 and earlier versions. An attacker could convince a user to open a specially crafted Visual Studio Code workspace that causes Visual Studio Code to connect to an attacker-controlled service while the workspace is open in Restricted Mode. Due to incomplete enforcement of Workspace Trust restrictions, the crafted workspace could bypass protections intended to prevent content in untrusted workspaces from running commands or code. Successful exploitation could allow an attacker to access local data or execute code in the context of the user. User interaction is required because the user must open the crafted workspace. However, the user does not need to grant trust to the workspace for exploitation to occur. ## Patches The fix is available starting with **Visual Studio Code 1.136.2**. The fix ([0684cb5](https://github.com/microsoft/vscode/commit/0684cb5905a3f23156f45a28135326e09310ff4d)) ensures that restricted workspace settings are correctly identified and filtered when processing nested configuration objects. Users should update to Visual Studio Code 1.136.2 or later. ## Workarounds Do not open Visual Studio Code workspaces from untrusted sources. Keep Workspace Trust enabled and do not grant trust to unfamiliar workspaces. These precautions reduce exposure but are not a substitute for updating Visual Studio Code. ## References - [Visual Studio Code issue #335112](https://github.com/microsoft/vscode/issues/335112) - [Fix commit 0684cb5](https://github.com/microsoft/vscode/commit/0684cb5905a3f23156f45a28135326e09310ff4d) - [MSRC entry for CVE-2026-81376](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81376) - [Visual Studio Code Workspace Trust documentation](https://code.visualstudio.com/docs/editor/workspace-trust)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 8 | Microsoft Skype for Business: spoofing | High8.3 | 6.0.9319.885+2 more |
| Sep 8 | Microsoft Skype for Business: cross-site scripting | Medium6.5 | 6.0.9319.885+2 more |
| Sep 8 | Microsoft Skype for Business: spoofing | High7.1 | 6.0.9319.885+2 more |
| Sep 8 | Microsoft Skype for Business: information disclosure | Medium6.5 | 6.0.9319.885+2 more |
| Sep 8 | Microsoft Skype for Business: integer overflow | High7.5 | 6.0.9319.885+2 more |
| Sep 8 | Microsoft Skype for Business: out-of-bounds read | Medium6.5 | 6.0.9319.885+2 more |