Visual Studio Code CVE-2026-81379

User interaction is required: the victim must open a crafted workspace, folder, URI, or file in VS Code (PR:N but UI:R). The vulnerability is reachable over the network, implying the failing-open path can be triggered by remotely-hosted content (e.g., a remote workspace, Live Share session, or Dev Container configuration). No authentication is required on the attacker's side. Exploitation is limited to Visual Studio Code versions below 1.136.2; users running auto-updated instances will have received the fix automatically. The scope change implies the attacker needs to reach VS Code's multi-process boundary, which is present in all standard VS Code deployments - no special non-default configuration is documented as required.

The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) is internally consistent with the failing-open description: a remote, unauthenticated attacker can trigger the bypass with low effort, but must engineer user interaction - the primary real-world friction. The high confidentiality impact combined with scope change suggests possible exposure of secrets, tokens, or cross-workspace data from another process or origin. No EPSS score was provided in the input data; no KEV entry is present; no POC has been disclosed. Given VS Code's wide developer footprint, targeted phishing campaigns delivering crafted workspaces or repository folders are a plausible threat vector. Risk is moderate-to-high for developer machines handling credentials, API keys, or sensitive source code - lower for air-gapped or non-networked installations.

An attacker crafts a malicious VS Code workspace or remote repository link and delivers it to a developer via email or a code-hosting platform. When the victim opens the workspace, VS Code's internal security feature check (such as workspace trust or an extension host authentication handshake) encounters a failure condition and defaults to an open/permitted state. The attacker's workspace content then gains unauthorized access to protected data in an adjacent scope - such as environment variables, stored secrets, or cross-process state - that the security feature was intended to isolate.