VS Code before 1.136.2 bypasses Workspace Trust (CVE-2026-81376)
A prepared workspace can reach an attacker service and run code as the user; Microsoft fixed it and paid the reporter $4,000.
3
Stories per day · 30 days
1 stories, newest first · one card per story
Stories tagged #visual-studio-code