Advisoriesby IbisAzure DevOps access token disclosure through GitHub Copilot Chat workspace settings
Impact
An information disclosure vulnerability in the GitHub Copilot Chat extension for Visual Studio Code could expose a user's Azure DevOps (ADO) access token.
The ADO Code Search integration allowed its endpoint URL to be overridden through workspace configuration. A malicious repository could include a .vscode/settings.json file that redirects ADO Code Search requests to an attacker-controlled server. When an authenticated ADO Code Search request is made using that configuration, the user's access token could be sent to the attacker-controlled endpoint.
The disclosed token could allow an attacker to access data and services that the user is authorized to use, potentially including sensitive organizational information.
Patches
The fix is available starting with Visual Studio Code 1.136.2.
The fix ([f94e10b](https://github.com/microsoft/vscode/commit/f94e10bbe33d0fa05ed03e1c25397b0625a93ce2)) removes the configurable ADO Code Search endpoint override, including the github.copilot.chat.workspace.prototypeAdoCodeSearchEndpointOverride setting and its legacy github.copilot.chat.advanced.workspace.prototypeAdoCodeSearchEndpointOverride equivalent.
ADO Code Search now derives its endpoint using the standard Azure DevOps URL construction rather than a workspace-controlled override.
Users should update to Visual Studio Code 1.136.2 or later.
Workarounds...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Visual Studio Code Product | < 1.136.2 | 1.136.2 |
Details and references
## Impact An information disclosure vulnerability in the GitHub Copilot Chat extension for Visual Studio Code could expose a user's Azure DevOps (ADO) access token. The ADO Code Search integration allowed its endpoint URL to be overridden through workspace configuration. A malicious repository could include a `.vscode/settings.json` file that redirects ADO Code Search requests to an attacker-controlled server. When an authenticated ADO Code Search request is made using that configuration, the user's access token could be sent to the attacker-controlled endpoint. The disclosed token could allow an attacker to access data and services that the user is authorized to use, potentially including sensitive organizational information. ## Patches The fix is available starting with **Visual Studio Code 1.136.2**. The fix ([f94e10b](https://github.com/microsoft/vscode/commit/f94e10bbe33d0fa05ed03e1c25397b0625a93ce2)) removes the configurable ADO Code Search endpoint override, including the `github.copilot.chat.workspace.prototypeAdoCodeSearchEndpointOverride` setting and its legacy `github.copilot.chat.advanced.workspace.prototypeAdoCodeSearchEndpointOverride` equivalent. ADO Code Search now derives its endpoint using the standard Azure DevOps URL construction rather than a workspace-controlled override. Users should update to Visual Studio Code 1.136.2 or later. ## Workarounds There are no known workarounds. Users should update to Visual Studio Code 1.136.2 or later. ## References - [Visual Studio Code issue #335123](https://github.com/microsoft/vscode/issues/335123) - [Fix commit f94e10b](https://github.com/microsoft/vscode/commit/f94e10bbe33d0fa05ed03e1c25397b0625a93ce2) - [MSRC entry for CVE-2026-81381](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81381) - [CVE record for CVE-2026-81381](https://www.cve.org/CVERecord?id=CVE-2026-81381)
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-522