VS Code before 1.136.2 bypasses Workspace Trust (CVE-2026-81376)
A prepared workspace can reach an attacker service and run code as the user; Microsoft fixed it and paid the reporter $4,000.
68
- Mentions · 7d0
- Mentions · 30d1
- All mentions2
- First seenAug 18, 2026
- Last mentioned21d ago
Timeline
2 articles · newest firstMicrosoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
Varonis discloses CoSnitch (CVE-2026-24301), three Microsoft Copilot Personal flaws enabling one-click exfiltration of connected-app data; patched August 18, 2026.
66
Related CVEs
by mentions- CVE-2026-81376<1%9.6Security Feature Bypass in Microsoft Visual Studio Code
- CVE-2026-243012%7.5Command Injection in Microsoft Copilot Allows Information Disclosure
- CVE-2026-24299<1%5.3Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information…
Appears with
- Microsoftvendor · 2
- Varonisvendor · 1
- NVDorganization · 1
- Visual Studio Codeproduct · 1
- Copilot Personalai model · 1
- Microsoft Copilot Personalproduct · 1
- Varonis Threat Labsorganization · 1
- Google Driveproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.