VS Code before 1.136.2 bypasses Workspace Trust (CVE-2026-81376)
A prepared workspace can reach an attacker service and run code as the user; Microsoft fixed it and paid the reporter $4,000.
3
Stories per day · 30 days
3 stories, newest first · one card per story
Stories tagged #workspace-trust
One Click in a Malicious VS Code Project Can Give Attackers Persistent Access to Your PC
Remedio researchers show crafted command: links in VS Code source editors can bypass Workspace Trust to install malicious extensions for persistent access.
3
Cursor Security Bug Allowed Repositories to Execute Commands Before Trust Verification
Cursor fixed a pre-trust bug letting untrusted repositories execute commands, then closed the report as informative.