workspace trust

Microsoft has issued Visual Studio Code 1.128.1 to address CVE-2026-57102, a high-severity security feature bypass affecting every VS Code release before that version. Developers and administrators should treat the update as an immediate priority: Microsoft’s CVSS 3.1 rating is 8.8 out of 10...

Organizations should immediately inventory every machine-wide and per-user Visual Studio Code installation, upgrade all releases earlier than 1.123.2, and require unfamiliar folders and workspace files to remain in Restricted Mode until both the editor and the workspace have been reviewed. That...

Microsoft disclosed CVE-2026-48569 on June 9, 2026, as an Important Visual Studio Code security feature bypass vulnerability caused by improper input validation, allowing an unauthorized attacker to bypass a security feature locally, with no public exploitation or prior disclosure reported at...

Microsoft disclosed CVE-2026-47281 on June 9, 2026, as an Important Visual Studio Code elevation-of-privilege vulnerability that can let an unauthenticated network attacker gain SYSTEM privileges if a user opens a malicious .code-workspace file in VS Code. The awkward part is not that...

A Microsoft Security Response Center entry and several third‑party trackers that cover developer‑tool security describe a worrying pattern: AI‑driven editor integrations such as GitHub Copilot and Visual Studio/Visual Studio Code extensions can, under certain conditions, be coerced into...

In recent days, the cybersecurity community has raised significant concerns regarding the discovery of CVE-2025-21264, a security feature bypass vulnerability impacting Visual Studio Code (VS Code), one of the world’s most popular code editors. As organizations, enterprises, and independent...