Remote Code Execution Vulnerability

HighCVE-2026-57102 · Published Jul 14, 2026

A remote code execution vulnerability exists in VS Code 1.128.0 and earlier versions where, if you host a standalone VS Code server via `code serve-web` or similar, an attacker with knowledge of the domain could retrieve the connection token used for the server. ### Patches The fix is available starting with **VS Code 1.128.1**. The fix (https://github.com/microsoft/vscode/commit/236fa7d8ea86f0f4261df38e1a17b3c7e7002bd0) mitigates this attack by performing validation of the origin of webview messages. ### Workarounds Do not use `code serve-web` or similar on versions of VS Code <=1.128.0 ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/236fa7d8ea86f0f4261df38e1a17b3c7e7002bd0 * An issue for this can be found at https://github.com/microsoft/vscode/issues/325836 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57102