CVE-2026-81381 is a medium severity (CVSS 6.5) insufficiently protected credentials flaw in GitHub Copilot and Visual Studio Code. An unauthorized attacker could disclose information over a network, with user interaction needed. Update Visual Studio Code and the Copilot extensions, and check the Microsoft entry for the exact fixed version.
What's affected
- Visual Studio Code, per the CVE record product list.
- GitHub Copilot, named in the record description.
- Fixed version: not confirmed by us. We could not read the Microsoft Security Update Guide page, because it needs JavaScript, so the product list and wording come from the CVE record. Open the Microsoft page for the exact update package for your build.
Record severity: CVSS 6.5 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The weakness class is CWE-522, Insufficiently Protected Credentials.
How to check if you're exposed
In Visual Studio Code, open the About dialog or read the editor version from the Help menu, then open the Extensions view to read the GitHub Copilot extension versions. Compare with the fixed version in the Microsoft entry. Managed fleets can report editor versions from their endpoint tools.
What to do now
- Read the Microsoft entry for the fixed version.
- Update Visual Studio Code, using Check for Updates or your software distribution tool.
- Update the GitHub Copilot extensions.
- Review which tokens and credentials developers keep in editor settings and rotate any you cannot account for.
- Add editor and extension versions to your developer workstation inventory.
Why it matters
The weakness class is insufficiently protected credentials (CWE-522). It means a secret such as a token is stored or sent in a way that others can read. In developer tools that connect to code hosting and AI services, those secrets can open source repositories.
The score is medium because the vector needs the user to interact and the impact covers confidentiality only. The record does not mark the CVE as exploited in the wild. Developer machines are a common route into source code, so a prompt update is cheap insurance.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version of VS Code fixes it?
We could not confirm it. Check the Microsoft Security Update Guide entry.
Does it change data?
The vector shows confidentiality impact only.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
