# VS Code: four MCP and agent flaws let a hostile server run code

> CVE-2026-120779 lets a hostile MCP server turn a VS Code notification into a command that runs when the user clicks it.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Vulnerability
- **Published by:** Microsoft
- **Disclosed:** 2026-11-10
- **CVE:** CVE-2026-120779
- **CVSS:** 9.6
- **Affects:** Visual Studio Code
- **Research by:** Visual Studio Code team
- **Primary source:** https://github.com/microsoft/vscode/security/advisories/GHSA-66hq-jw93-462h
- **Page:** https://theinjection.dev/items/microsoft-vscode-1-145-3-mcp-agent-cves/

Visual Studio Code 1.145.3 fixes four flaws in its MCP client and agent mode, including CVE-2026-120779, a CVSS 9.6 remote code execution bug a connected MCP server can trigger with one click. 1.145.2 and earlier are affected.

## What happened

Microsoft published four security advisories for Visual Studio Code on 10 November 2026, all fixed in version 1.145.3. Three cover the editor's MCP client and the fourth covers agent mode. The VS Code team filed and fixed the issues itself, and no outside researcher is credited on any of the four advisories.

## How it works

Each flaw comes from VS Code trusting data that an MCP server or a link supplied. Elicitation notification text was rendered as a clickable command link, so server-controlled content became a runnable command. A crafted vscode:mcp/install link could carry command-backed inputs that the install preview did not show. The legacy SSE transport accepted a server-supplied endpoint without checking its origin, and local-command syntax inside an agent message was handled as if the user had typed it.

## Who is affected

Visual Studio Code 1.145.2 and earlier are affected on every platform. Three of the four flaws need a connected MCP server or an opened install link, so a user who adds no MCP servers is not exposed to those. CVE-2026-120782 instead reaches anyone running agent mode against a repository with untrusted instructions.

## What to do

Update to Visual Studio Code 1.145.3. Keep terminal approvals enabled and avoid session-wide tool permissions in repositories whose instructions you do not trust. Do not open vscode:mcp/install links from untrusted sources, and review the server configuration before approving an install.

## Quick facts

- **Affected:** Visual Studio Code 1.145.2 and earlier
- **Fixed in:** Visual Studio Code 1.145.3
- **CVEs:** CVE-2026-120779, CVE-2026-114171, CVE-2026-119983, CVE-2026-120782
- **CVSS:** 9.6, 8.8, 8.8 and 7.8, Microsoft base scores
- **Found by:** Microsoft's Visual Studio Code team
- **Disclosed:** 10 November 2026
- **Status:** Fixed, users must update

## Questions

### Which VS Code version fixes the MCP flaws?

Visual Studio Code 1.145.3 fixes all four flaws. Microsoft published the advisories on 10 November 2026 and lists 1.145.2 and earlier as affected. Anyone who installed the 1.145 release when it shipped on 4 November is running an unpatched build, so check the version and update. Forks and derived editors ship on their own schedule and may lag behind.

### Am I affected if I never add MCP servers to VS Code?

Three of the four flaws need a connected MCP server or a crafted install link, so a user who adds no MCP servers is not exposed to those three. CVE-2026-120782 is different. Local-command syntax inside an agent message could run without the expected terminal approval, which reaches anyone using agent mode against untrusted repository instructions.

### Were these VS Code flaws exploited in the wild?

Microsoft reports no known exploitation and no public disclosure before the fix for all four CVEs, and rates exploitation as unlikely. Every advisory carries the exploit code maturity value E:U, meaning Microsoft knows of no exploit code. The VS Code team filed the issues on 10 November 2026 and closed them the same day.

### How does the elicitation flaw differ from the install-link flaw?

CVE-2026-120779 abuses elicitation notifications: a connected MCP server supplied message content that Visual Studio Code rendered as a clickable command link, so activating it ran code. CVE-2026-114171 works earlier, at install time. A crafted install link carried command-backed inputs that the preview did not surface, so approving the install ran an attacker-chosen command.

## Sources

1. [GHSA Elicitation RCE](https://github.com/microsoft/vscode/security/advisories/GHSA-66hq-jw93-462h)
2. [GHSA Install Links](https://github.com/microsoft/vscode/security/advisories/GHSA-crhv-2887-p3xr)
3. [GHSA SSE Endpoints](https://github.com/microsoft/vscode/security/advisories/GHSA-4x35-6qr8-ww48)
4. [GHSA Local Commands](https://github.com/microsoft/vscode/security/advisories/GHSA-w9fm-7vcm-cvq4)
5. [VS Code 1.145 Release](https://code.visualstudio.com/updates/v1_145)