Intro
I just started a new semester and have been busy with coursework and a few other things, so the full writeup is not ready yet. I will update this page once I have time to finish it.
This issue had been hiding in VS Code's Workspace Trust mechanism for quite a while. It was a Security Feature Bypass that could be exploited to achieve remote code execution.
Bounty
Microsoft awarded me US$4,000 for this report!
Timeline
- - Reported the issue to MSRC.
- - MSRC opened the case and changed its status to “Review/Repro.”
- - MSRC confirmed the issue and changed the case status to “Develop.”
- - The bounty team determined that the report was eligible for a US$4,000 bounty.
- - Asked MSRC for clarification on the basis for the bounty assessment.
- - MSRC replied that, under the Open Source Bounty Program, the report was assessed as Important, High Quality, and an Improper Input Validation issue, resulting in a US$4,000 award.
- - MSRC confirmed that the issue had been fixed and that a security advisory would be published on the next Patch Tuesday. The case status changed to “Pre-Release.”
- - The security advisory was published, and the issue was assigned CVE-2026-81376.
- - Publicly disclosed the issue.