VS Code trusted remote workspaces before users decided

Microsoft has patched a Workspace Trust bypass in Visual Studio Code that could let a remote workspace file start processes before the user agreed to trust it. The flaw, CVE-2026-119985, affects VS Code 1.145.2 and earlier when someone opens an HTTP or HTTPS workspace configuration file.

VS Code is supposed to treat unreviewed folders and settings as untrusted so they cannot launch tasks, debug sessions, or other processes. In this case the editor could mark a network-backed workspace trusted and apply those settings first. An attacker still needed the victim to open a crafted link. Once that happened, workspace settings such as MCP server definitions could start an attacker-controlled process.

The fix ships in VS Code 1.145.3. According to the advisory, HTTP and HTTPS workspace resources now follow the normal Workspace Trust rules and require an explicit trust decision before process-starting settings apply.

Until the update is installed, Microsoft advises against opening remote .code-workspace links from untrusted sources. Users should download and review configuration files before opening them locally, and should not grant Workspace Trust to content they have not reviewed.