CVE-2026-81376

CVE-2026-81376 is a security feature bypass vulnerability affecting Microsoft Visual Studio Code versions 1.0.0 through 1.136.1. The flaw stems from an incomplete comparison operation within the application's security evaluation logic, which is categorized as a protection mechanism failure. When Visual Studio Code assesses a security decision, the comparison logic omits certain necessary factors. An attacker can exploit this by crafting input that satisfies the partial check while violating the omitted factors, allowing them to bypass the editor's built-in security controls. Exploitation of this vulnerability requires user interaction, such as opening a repository, workspace, or file supplied by the attacker. Once triggered over a network, the bypass can lead to a scope change, enabling the compromised component to affect resources outside its intended security boundary. This can result in behaviors such as the unexpected launching of command shells, scripting interpreters, or network utilities, as well as unauthorized modifications to configuration files within the workspace. Microsoft has addressed this issue in Visual Studio Code version 1.136.2.