Microsoft's October 2026 security release on 13 October listed ten CVEs for Visual Studio Code, all fixed in version 1.141.1. Two are specific to AI features: CVE-2026-102232 lets prompt injection push the Copilot agent into editing a lifecycle-hook file without the expected confirmation, and CVE-2026-102851 lets one sandboxed MCP server write into another server's directory. The rest include Workspace Trust bypasses and four remote code execution bugs that need a user to open or click something.
What's affected
Every CVE below lists Visual Studio Code with the fix in 1.141.1. Microsoft marks all of them as not publicly disclosed, not exploited, and "Exploitation Less Likely."
AI agent and MCP issues
- CVE-2026-102232 (CVSS 7.0, security feature bypass). Microsoft's FAQ: "An attacker could supply specially crafted content that an AI coding agent processes," which "could allow the attacker to modify a configured lifecycle-hook file without the expected confirmation, which could result in commands executing in the context of the user." It requires prompt injection, Copilot agent interaction and triggering a build. Credited to Max van Amersfort.
- CVE-2026-102851 (CVSS 6.1, security feature bypass). A user adds and starts a crafted sandboxed MCP server alongside another sandboxed server. The attacker's server can then write into the other server's directory, bypassing the per-server sandbox policy and potentially running code under the other server's permissions.
Workspace Trust bypasses
- CVE-2026-102231 (7.7), CVE-2026-102233 (7.8) and CVE-2026-102234 (7.4) each allow content from an untrusted workspace to run commands or code without the user granting trust.
- CVE-2026-70098 (8.8, RCE): opening a crafted workspace can bypass Workspace Trust and run code. "The user does not need to grant trust."
Other remote code execution and disclosure
- CVE-2026-102238 (9.6): importing a crafted VS Code profile, or opening crafted content or links, can bypass path containment checks and lead to code execution.
- CVE-2026-102235 (8.8): crafted output in the integrated terminal produces a notification link; clicking it can run commands.
- CVE-2026-69370 (8.8): command injection triggered by opening a crafted file.
- CVE-2026-102229 (6.8, information disclosure): a path traversal that, by escaping the sandbox, allows reading local files.
VS Code 1.141 itself shipped on 7 October. Its release notes describe sandboxing for Copilot agent operations, enabled with the chat.agent.sandbox.enabled setting, and say locally launched MCP servers are sandboxed by default when sandboxing is on. The notes also say sandboxing "does not replace endpoint security or provide a standalone security boundary."
How to check if you're exposed
Check the version on each machine:
code --version | head -1
Anything below 1.141.1 is unpatched. Remote and container setups run their own VS Code Server, so check those hosts too:
ls ~/.vscode-server/bin/ 2>/dev/null
For CVE-2026-102851, list which MCP servers each workspace starts and where they come from. Look at the .vscode/mcp.json files committed to your repositories:
git ls-files | grep -E '(^|/)\.vscode/mcp\.json$'
For CVE-2026-102232, the risk is highest where the Copilot agent works on content you don't control: issues, pull requests from forks, vendored code, or web pages it fetches.
What to do now
-
Update to 1.141.1 or later. VS Code auto-updates by default, but confirm it on managed devices and on any pinned versions in dev containers or remote images.
-
Turn agent sandboxing on. In user or managed settings:
{ "chat.agent.sandbox.enabled": true }The 1.141 notes say enterprises can require sandboxing through managed settings with bypass disallowed.
-
Review lifecycle-hook files in code review. Treat any agent edit to hook or build configuration as a change that needs a human reviewer, regardless of what the agent reports.
-
Only add MCP servers you trust, and keep each server's directory separate. CVE-2026-102851 starts with a user adding a crafted server.
-
Keep Workspace Trust on and open unfamiliar repositories in Restricted Mode. Four of these CVEs bypass Trust, but the fix restores it, and it still blocks the ordinary cases.
-
Be careful with imported profiles and terminal links. CVE-2026-102238 and CVE-2026-102235 both depend on a user action that feels routine.
Why it matters
Editors now host agents that read untrusted text and then act. CVE-2026-102232 is the clean example: the attacker never touches the developer's machine directly. They plant instructions where the agent will read them, and the agent edits a file that later runs commands during a build.
MCP sandboxing is new, and CVE-2026-102851 shows the first kind of bug any new isolation layer gets: one tenant reaching into a neighbor's space. Microsoft's own release notes say the sandbox is not a standalone boundary. That is the right way to read it. Sandboxing reduces blast radius. It does not make an untrusted MCP server safe to run.
The Workspace Trust bypasses are a reminder that "open folder" remains one of the riskiest actions in a developer's day.
Try it yourself
Pick one repository that ships a .vscode/mcp.json file. Write down each server it launches, the command it runs, and what the server can reach. Then see how an MCP guardrail can restrict which servers and tools an agent may call.
Click through it at your own pace, or open it full screen.
Quick check
Does CVE-2026-102232 work without the Copilot agent?
No. Microsoft says exploitation requires prompt injection, Copilot agent interaction and triggering a build.
Has any of these been exploited?
Microsoft lists all ten as not publicly disclosed and not exploited at release, with exploitation rated less likely.
Is MCP sandboxing a security boundary I can rely on?
VS Code's own 1.141 release notes say it does not replace endpoint security or provide a standalone security boundary. Treat it as one layer.
