VS Code 1.141.1 fixes ten CVEs: profile-import RCE (CVE-2026-102238, 9.6), terminal-link RCE, three Workspace Trust bypasses, agent hook and MCP sandbox gaps

View raw markdownEdit on GitHub ↗

TL;DR

Microsoft published ten Visual Studio Code CVEs on 2026-10-13, all affecting 1.0.0 up to but not including 1.141.1, all fixed in 1.141.1 (tagged the same day). Four are remote code execution: importing a crafted profile or opening crafted content bypasses path containment (CVE-2026-102238, CVSS 9.6), crafted terminal output plus one click on the notification it produces runs commands (CVE-2026-102235, 8.8), opening a crafted file (CVE-2026-69370, 8.8) and opening a crafted workspace without granting trust (CVE-2026-70098, 8.8). Three more bypass Workspace Trust (CVE-2026-102231, CVE-2026-102233, CVE-2026-102234). Two are in the agent surface: content an AI coding agent processes can change a configured lifecycle-hook file without the expected confirmation (CVE-2026-102232, 7.0), and one sandboxed MCP server can write into another's directory (CVE-2026-102851, 6.1). One is a sandbox file read (CVE-2026-102229, 6.8). Microsoft lists none as exploited or publicly disclosed. Update to 1.141.1, and treat a fork still on an older VS Code base as unpatched until it says otherwise.

What happened

The October 2026 Microsoft security release carried ten records for the product "Visual Studio Code", each with the CNA affected range 1.0.0 to < 1.141.1 and the release date 2026-10-13. The 1.141.1 tag on microsoft/vscode is dated 13 October and its visible commit reads "Fix MCP sandbox permission approval isolation (MSRC …)", which matches the per-server sandbox record below. VS Code's own release notes page says only that 1.141.1 "addresses these security issues" and links the milestone; the ids come from MSRC and CVE Services, not from the editor's changelog.

Microsoft's descriptions are one sentence each. The mechanism, where there is one, is in the record's FAQ, which is the text quoted here. All scores are Microsoft's CVSS 3.1 base scores, published 2026-10-13.

CVE Score CWE What the FAQ says
CVE-2026-102238 9.6 (scope changed) CWE-22 Convince a user to import a crafted VS Code profile or open crafted content or links; bypasses path-containment checks, reaching locations outside the intended ones, with code execution as the user.
CVE-2026-102235 8.8 CWE-116 Cause crafted content to appear in the integrated terminal; if the user clicks the resulting notification link, commands run as the user. No authentication.
CVE-2026-69370 8.8 CWE-77 The user opens a crafted file from the attacker.
CVE-2026-70098 8.8 CWE-862 The user opens a crafted workspace; Workspace Trust is bypassed and attacker content executes "but the user does not need to grant trust".
CVE-2026-102233 7.8 (local) missing authorization Workspace Trust bypass: untrusted-workspace content runs commands or code without trust being granted.
CVE-2026-102231 7.7 (local, high complexity) CWE-41 path equivalence The same Workspace Trust bypass outcome, through a path-equivalence flaw.
CVE-2026-102234 7.4 (network) reliance on untrusted input The same Workspace Trust bypass outcome, over the network.
CVE-2026-102232 7.0 (local, high complexity) CWE-863 "An attacker could supply specially crafted content that an AI coding agent processes"; the agent modifies a configured lifecycle-hook file without the expected confirmation, and commands execute as the user. Microsoft's own complexity note: "prompt injection, Copilot Agent interaction" and a trigger are all required.
CVE-2026-102229 6.8 CWE-22 Information disclosure "by escaping the sandbox", which the FAQ defines as the ability to read local files.
CVE-2026-102851 6.1 (local, high complexity) CWE-266 Convince a user to add and start a crafted sandboxed MCP server alongside another; the attacker's server writes into the other server's directory, bypassing the per-server sandbox policy, and may run code under the other server's permissions.

Three things to read across the table:

  1. Workspace Trust had five holes in one release (CVE-2026-70098 and the three feature-bypass records, plus the profile-import path escape that reaches the same outcome). This corpus tracked a Remedio report on 2026-09-17 of a one-link extension install from a Restricted Mode file that MSRC rated Moderate and gave no CVE. None of today's records names that report, its mechanism or its reporter, so no pairing is claimed here; the records are the vendor's own, with no acknowledgements field populated.
  2. The agent surface now has its own CVEs in the editor itself. CVE-2026-102232 is the editor-side version of the hook and settings-file writes this corpus has recorded in Claude Code, Cursor and, this same Patch Tuesday, Visual Studio's Copilot: content the agent reads becomes an edit to the file that decides what runs on the next lifecycle event. CVE-2026-102851 is the first MCP per-server sandbox record for VS Code.
  3. The terminal is an input. CVE-2026-102235 needs nothing but output the attacker controls in the integrated terminal and a click on the notification VS Code raises from it. A build step, a test runner or an agent's tool call that prints attacker text is enough to put that output there.

Microsoft marks every record "Exploitation Less Likely", not exploited and not publicly disclosed, as of 2026-10-13. This is the third VS Code CVE batch since July, after the July 1.128.1 batch and the August records CVE-2026-69320 and CVE-2026-70336 (CNA Microsoft, published 2026-08-11, affected 1.0.0 to < 1.132.1); the cadence is one Patch Tuesday point release a month.

Forks

Cursor, Windsurf and Antigravity are built on VS Code and ship their own numbered releases on an older upstream base. The CNA records name only "Visual Studio Code". Whether each fork carries each fix is a question for that fork's release notes, and none had published a statement on 2026-10-14. Until one does, the honest reading is that a fork whose upstream base predates 1.141.1 has the pre-fix code for the parts it did not rewrite.

Am I affected?

# VS Code version; below 1.141.1 is affected
code --version | head -1

# Forks report their own version, not the upstream base. Help > About shows the
# VS Code base ("Electron" and "VS Code" lines). Below 1.141.1 means the fork
# has not yet rebased past the fix.

Then the two checks that matter for the agent records:

# Lifecycle hook files an agent could have edited (CVE-2026-102232): review for
# commands you did not add. Paths vary by agent; these are the common ones.
ls -la .vscode/ .claude/ .cursor/ 2>/dev/null
git log -p -- .vscode/settings.json .vscode/tasks.json .claude/settings.json 2>/dev/null | head -120

# Sandboxed MCP servers (CVE-2026-102851): list what is configured and when it was added
cat .vscode/mcp.json 2>/dev/null

A profile you imported from a link or a file you did not write, between the date you installed it and your update to 1.141.1, is the artefact for CVE-2026-102238; the editor does not record where an imported profile came from, so that list is yours to write.

If you are affected

Update to 1.141.1 or later. If the editor ran attacker content in a workspace you had not trusted, or an agent session edited a hook file you did not expect, treat the account as compromised and follow if your local AI agent was exploited, then rotating cloud credentials for anything the editor's terminal could reach.

Prevention

  • Keep the editor on auto-update. Microsoft ships VS Code security fixes as point releases on Patch Tuesday with no CVE in the editor's own release notes; the only way to know a fix landed is to be on the newest build.
  • Open untrusted repositories in Restricted Mode and read the trust prompt as a boundary that this release had five holes in, not as a guarantee. agent-sandboxing covers the container-first alternative.
  • Review every agent hook and MCP configuration edit the way you review a commit. mcp-hygiene.
  • On a fork, read its release notes for the upstream VS Code version it is based on and compare against 1.141.1.

Sources