VS Code fixes 10 security flaws, including three MCP remote code execution bugs

Microsoft's VS Code team published ten security advisories on November 10, 2026, including three high severity remote code execution flaws tied to the editor's Model Context Protocol implementation and an agent command approval bypass. All ten issues are fixed in 1.145.3, as detailed in Microsoft's advisory on the MCP elicitation flaw.

What changed

• GHSA-66hq-jw93-462h (CVE-2026-120779, CVSS 8.3): a malicious MCP server's elicitation notification could render as an executable VS Code command link, affecting versions before 1.145.2.
• GHSA-crhv-2887-p3xr (CVE-2026-114171, CVSS 7.7): crafted vscode:mcp/install links could smuggle unsafe command backed input variables past validation and execute commands after installation.
• GHSA-4x35-6qr8-ww48 (CVE-2026-119983, CVSS 7.7): the legacy MCP SSE transport did not validate server supplied alternate endpoints, enabling redirect or credential exposure.
• GHSA-w9fm-7vcm-cvq4 (CVE-2026-120782, CVSS 6.8): local command syntax inside agent generated messages, such as untrusted repository instructions, could run without terminal approval because command origin was not tracked.
• GHSA-f56j-7499-5hch (CVE-2026-102230): an agent manipulated by malicious page content in the integrated browser could upload local files outside the workspace without the usual approval gate.

What it means for builders

This is the largest single day batch of MCP specific remote code execution disclosures in VS Code to date, and it is directly actionable for anyone running GitHub Copilot or third party MCP servers inside the editor. The elicitation and installer flaws show how an untrusted MCP server could trick the editor into executing a command, while the agent approval bypass and browser upload bug show that agent generated or page sourced content can also slip past the approval prompts meant to catch unsafe actions. Together the ten advisories add concrete evidence to the wider debate over where MCP's trust boundaries should sit.

Fix availability

All ten vulnerabilities are fixed in VS Code 1.145.3. Microsoft states it has no record of exploitation of the MCP or agent related flaws to date. The full set of advisories, each dated November 10, 2026, is listed in the VS Code security advisories index.

Sources

• Remote Code Execution via MCP Elicitation Notifications (GitHub (microsoft/vscode), November 10, 2026, official)
• VS Code Security Advisories index (GitHub (microsoft/vscode), November 10, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.