Secret exfiltration vulnerability

HighCVE-2026-47282 · Published Jul 14, 2026

## VS Code - Secret exfiltration vulnerability A secret exfiltration vulnerability exists in VS Code 1.128.0 and earlier versions where, if you open a malicous workspace that contains hidden advanced copilot settings in the workspace settings your Copilot token (30m lifetime) may be sent to a malicious upstream server. ### Patches The fix is available starting with **VS Code 1.128.1**. The fix (https://github.com/microsoft/vscode/commit/f05bcd1aa29cff28a62fe137b4a16fec9393f31b) mitigates this attack by only respecting hidden advanced settings in a trusted workspace. ### Workarounds Use external tooling to inspect workspace settings for any malicious URLs prior to opening an untrusted workspace on versions of VS Code <=1.128.0 ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/f05bcd1aa29cff28a62fe137b4a16fec9393f31b * An issue for this can be found at https://github.com/microsoft/vscode/issues/325846 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47282