{
"document": {
"acknowledgments": [
{
"names": [
"Jiyong Yang (@Sy2n0)"
]
},
{
"names": [
"Nguyen Van Minh Duc with Saigon Newport Corporation"
]
},
{
"names": [
"Dimitris Chatzis"
]
}
],
"aggregate_severity": {
"namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
},
{
"category": "general",
"text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
"title": "Customer Action"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2026-81379 Visual Studio Code Security Feature Bypass Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81379"
},
{
"category": "self",
"summary": "CVE-2026-81379 Visual Studio Code Security Feature Bypass Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-81379.json"
},
{
"category": "external",
"summary": "Microsoft Exploitability Index",
"url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "Visual Studio Code Security Feature Bypass Vulnerability",
"tracking": {
"current_release_date": "2026-09-11T07:00:00.000Z",
"generator": {
"date": "2026-11-03T01:26:25.558Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2026-81379",
"initial_release_date": "2026-09-08T07:00:00.000Z",
"revision_history": [
{
"date": "2026-09-08T07:00:00.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
},
{
"date": "2026-09-11T07:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Updated an acknowledgement. This is an informational change only."
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "<1.136.2",
"product": {
"name": "Visual Studio Code <1.136.2",
"product_id": "1"
}
},
{
"category": "product_version",
"name": "1.136.2",
"product": {
"name": "Visual Studio Code 1.136.2",
"product_id": "11622"
}
}
],
"category": "product_name",
"name": "Visual Studio Code"
}
],
"category": "vendor",
"name": "Microsoft"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-81379",
"cwe": {
"id": "CWE-636",
"name": "Not Failing Securely ('Failing Open')"
},
"notes": [
{
"category": "general",
"text": "Microsoft",
"title": "Assigning CNA"
},
{
"category": "faq",
"text": "An attacker could influence content processed by the Visual Studio Code agent so that it requests a specially crafted URL. Successful exploitation could bypass configured network restrictions and allow access to resources that the policy is intended to block. User interaction is required to run the agent against attacker-controlled content.",
"title": "How could an attacker exploit this vulnerability?"
},
{
"category": "faq",
"text": "An attacker who successfully exploited this vulnerability could bypass the network access restrictions enforced for the Visual Studio Code agent, allowing outbound connections to resources that the configured policy is intended to block.",
"title": "What security feature could be bypassed by successfully exploiting this vulnerability?"
}
],
"product_status": {
"fixed": [
"11622"
],
"known_affected": [
"1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-81379 Visual Studio Code Security Feature Bypass Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81379"
},
{
"category": "self",
"summary": "CVE-2026-81379 Visual Studio Code Security Feature Bypass Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-81379.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-08T07:00:00.000Z",
"details": "1.136.2:Security Update:https://code.visualstudio.com/updates/v1_136",
"product_ids": [
"1"
],
"url": "https://code.visualstudio.com/updates/v1_136"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 7.1,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Security Feature Bypass"
},
{
"category": "exploit_status",
"details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely"
}
],
"title": "Visual Studio Code Security Feature Bypass Vulnerability"
}
]
}