Apply patch sensitive file workaround
High8.8CVE-2026-41109 · Published May 12, 2026
## VS Code - Remote Code Execution Vulnerability A remote code execution vulnerability exists in VS Code 1.119.0 and earlier versions where a crafted prompt-injection on certain GPT family models can cause the agent to edit sensitive files without presenting confirmation to the user. ### Patches The fix is available starting with **VS Code 1.119.1**. The fix (https://github.com/microsoft/vscode/commit/be09b4c7a118ae389662646f4fb9dcaa84757521) mitigates this attack by validating paths are unchanged after patch healing. ### Workarounds Avoid including untrusted data in GPT prompts. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/be09b4c7a118ae389662646f4fb9dcaa84757521 * An issue for this can be found at https://github.com/microsoft/vscode/issues/316071 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 9 | Path traversal in profile snippets import allows writing files outside the profile directory (Zip-Slip) | Medium | 1.123.1 |
| Jun 9 | Auto-Approved File Write via Unconfirmed Environment-Variable Path Redirection | Low | 1.123.1 |
| Jun 9 | Unconfirmed Remote Host Connection via Workspace File | High | 1.123.1 |
| May 12 | MCP Deeplink Install Lacked Essential Information | High8.8 | No fix yet |
| May 12 | Remote Code Execution Vulnerability in webviews | Medium | 1.119.1 |
| May 12 | Remote Code Execution Vulnerability with Jupyter notebook markdown rendering in untrusted workspaces | Medium | 1.119.1 |