Blog

CVE-2026-81376 VSCode RCE: Cracking Your settings.json Through Nested Workspace Settings (Coming Soon)

Three-headed dragon meme labeled Restricted Settings Filter, Workspace Trust, and Nested Object Form.

Intro

I just started a new semester and have been busy with coursework and a few other things, so the full writeup is not ready yet. I will update this page once I have time to finish it.

This issue had been hiding in VS Code's Workspace Trust mechanism for quite a while. It was a Security Feature Bypass that could be exploited to achieve remote code execution.

Bounty

Microsoft awarded me US$4,000 for this report!

MSRC email confirming eligibility for a US$4,000 bounty.
MSRC email explaining the assessment behind the US$4,000 bounty.

Timeline

  • - Reported the issue to MSRC.
  • - MSRC opened the case and changed its status to “Review/Repro.”
  • - MSRC confirmed the issue and changed the case status to “Develop.”
  • - The bounty team determined that the report was eligible for a US$4,000 bounty.
  • - Asked MSRC for clarification on the basis for the bounty assessment.
  • - MSRC replied that, under the Open Source Bounty Program, the report was assessed as Important, High Quality, and an Improper Input Validation issue, resulting in a US$4,000 award.
  • - MSRC confirmed that the issue had been fixed and that a security advisory would be published on the next Patch Tuesday. The case status changed to “Pre-Release.”
  • - The security advisory was published, and the issue was assigned CVE-2026-81376.
  • - Publicly disclosed the issue.