VS Code before 1.136.2 bypasses Workspace Trust (CVE-2026-81376)
Original title: Microsoft Pays Researcher $4,000 for Discovering Critical VS Code Security Bypass Flaw
A prepared workspace can reach an attacker service and run code as the user; Microsoft fixed it and paid the reporter $4,000.
Microsoft fixed CVE-2026-81376, a Workspace Trust bypass in Visual Studio Code versions from 1.0.0 to before 1.136.2, scored CVSS 9.6. NVD describes a network-triggerable security-feature bypass that needs user interaction and can affect confidentiality, integrity, and availability. Microsoft says a specially prepared workspace could connect to an attacker-controlled service, expose local data, or run code as the logged-in user. Researcher Sam Chen reported it to MSRC on May 23, 2026; the advisory appeared on September 8 and his disclosure on September 10. No public proof of concept or malware campaign is described.
Unconfirmed: Chen's full technical write-up is not yet public, and no complete proof of concept is available.
- Users should install VS Code 1.136.2 or later and confirm the editor restarted.
- MSRC confirmed the issue on June 3 and awarded $4,000 on June 9 under the Open Source Bounty Program.
- Microsoft classified the bounty report as Important and an improper input validation issue.
- The advisory calls the bug an incomplete comparison with missing factors.
Impact: Local data exposure or code execution as the logged-in user
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Visual Studio Code | 1.0.0 to before 1.136.2 | 1.136.2 or later |
- 1.Update Visual Studio Code to 1.136.2 or later, including extra installations.
- 2.Keep Workspace Trust enabled and use Restricted Mode for unfamiliar projects.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-81376 | Security Feature Bypass in Microsoft Visual Studio Code | 9.6 | <1% |
From the original article
4 min read at gbhackers.com
Microsoft awarded security researcher Sam Chen US$4,000 for reporting a flaw in Visual Studio Code that could let an attacker bypass Workspace Trust protections. The issue, tracked as CVE-2026-81376, affects VS Code versions earlier than 1. 136.
By Tushar Subhra · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.