Remote Code Execution Vulnerability

A remote code execution vulnerability exists in VS Code 1.128.0 and earlier versions where, if you host a standalone VS Code server via code serve-web or similar, an attacker with knowledge of the domain could retrieve the connection token used for the server.

Patches

The fix is available starting with VS Code 1.128.1. The fix (https://github.com/microsoft/vscode/commit/236fa7d8ea86f0f4261df38e1a17b3c7e7002bd0) mitigates this attack by performing validation of the origin of webview messages.

Workarounds

Do not use code serve-web or similar on versions of VS Code <=1.128.0

References

• The patch for this can be found at https://github.com/microsoft/vscode/commit/236fa7d8ea86f0f4261df38e1a17b3c7e7002bd0
• An issue for this can be found at https://github.com/microsoft/vscode/issues/325836
• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57102