Am I affected by CVE-2026-102851 in Visual Studio Code?

Visual Studio Code installations on 1.141.0 or earlier that run MCP servers with sandboxing enabled are affected. Exploitation requires an attacker-controlled MCP server sitting in a configuration that already holds sandbox permissions a user approved for a different server. Microsoft marks customer action as required, so updating is a more reliable answer than auditing each configuration by hand.

Which Visual Studio Code version fixes the MCP sandbox approval bypass?

Version 1.141.1 fixes the bypass, and Microsoft lists it as the fixed build for CVE-2026-102851. The Visual Studio Code 1.141 release notes record that the 1.141.1 update addresses security issues. The patch scopes sandbox grants and saved approvals to individual servers, limits shared configuration to deny rules, and writes server-specific filenames for generated sandbox settings.

Do sandbox approvals granted before the Visual Studio Code fix still apply?

Grants left in the old shared configuration are ignored after the update rather than carried over, according to the fix description in the microsoft/vscode security issue. Users who relied on previously approved network or filesystem-write permissions are asked again, now per server. Re-approving is a chance to check which MCP servers genuinely need each grant.

MEDVulnerability

VS Code: one MCP server could inherit another's sandbox approvals

CVE-2026-102851 let one MCP server in Visual Studio Code use the sandbox permissions a user had approved for a different server.

October 13, 2026 · Microsoft · Research by Visual Studio Code team

CVE-2026-102851

MEDVulnerability

CVE-2026-102851 is a security feature bypass in Visual Studio Code: MCP sandbox approvals for network access and filesystem writes were saved in shared configuration, so one server could use permissions granted to another.

01What happened

Microsoft disclosed CVE-2026-102851 on October 13, 2026 and shipped the fix the same day in Visual Studio Code 1.141.1. The flaw was filed and closed as a security issue in the microsoft/vscode repository, labelled mcp and security. MSRC rates the impact Important and acknowledges no outside reporter, so the finding is Microsoft's own.

02How it works

Visual Studio Code stored MCP sandbox approvals in a shared sandbox configuration instead of scoping each grant to the server that requested it. Network access and filesystem-write permissions recorded there then applied to any MCP server reading the same configuration. The patch scopes grants and saved approvals to individual servers, restricts shared configuration to deny rules, and writes server-specific filenames for generated sandbox settings.

03Who is affected

Visual Studio Code 1.141.0 and earlier, on installations that run MCP servers with sandboxing enabled. Microsoft marks customer action as required. Exploitation needs an attacker-controlled MCP server placed in a configuration that already holds permissions the user approved for a different server, which is why MSRC scores the attack complexity high.

04What to do

Update Visual Studio Code to 1.141.1 or later, the build Microsoft lists as fixed. Then review which MCP servers each workspace loads and re-approve the permissions they need, because the fix ignores grants left in the old shared configuration rather than migrating them.

Questions people ask

Am I affected by CVE-2026-102851 in Visual Studio Code?: Visual Studio Code installations on 1.141.0 or earlier that run MCP servers with sandboxing enabled are affected. Exploitation requires an attacker-controlled MCP server sitting in a configuration that already holds sandbox permissions a user approved for a different server. Microsoft marks customer action as required, so updating is a more reliable answer than auditing each configuration by hand.
Which Visual Studio Code version fixes the MCP sandbox approval bypass?: Version 1.141.1 fixes the bypass, and Microsoft lists it as the fixed build for CVE-2026-102851. The Visual Studio Code 1.141 release notes record that the 1.141.1 update addresses security issues. The patch scopes sandbox grants and saved approvals to individual servers, limits shared configuration to deny rules, and writes server-specific filenames for generated sandbox settings.
Do sandbox approvals granted before the Visual Studio Code fix still apply?: Grants left in the old shared configuration are ignored after the update rather than carried over, according to the fix description in the microsoft/vscode security issue. Users who relied on previously approved network or filesystem-write permissions are asked again, now per server. Re-approving is a chance to check which MCP servers genuinely need each grant.

Sources 4 links, all fetched

1github.comVS Code Security Issue
2github.comGitHub Advisory
3msrc.microsoft.comMSRC Advisory
4code.visualstudio.comVS Code 1.141 Notes