Loading vulnerability…
Remote Code Execution in Visual Studio Code MCP Notifications
CVE-2026-120779 is a code-injection vulnerability in Microsoft Visual Studio Code versions 1.0.0 through versions before 1.145.3. When a remote Model Context Protocol (MCP) server submits an elicitation request without an available chat session, McpElicitationService falls back to a workbench notification. The notification renderer interprets server-controlled strings as linked text, allowing embedded command links to invoke workbench commands when clicked. Non-string message objects can also impersonate the renderer's internal linked-text structure. A malicious server can exploit either path to execute code with the user's permissions after the user clicks a crafted notification link.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution with the permissions of the user running Visual Studio Code, potentially compromising information, modifying accessible data, and disrupting resources available to that account. The vulnerability does not itself grant administrator or SYSTEM privileges. Microsoft assigned a CVSS 3.1 base score of 9.6 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
If you can’t patch tonight, do this now.
No dedicated workaround is identified. As interim exposure-reduction measures, disable MCP support using the ChatMCP policy setting off, or restrict MCP servers to a curated registry using registryOnly. Review server provenance and repository configuration before approving connections, and avoid clicking unexpected MCP notification links. These controls are not substitutes for patching. Sandboxing locally running stdio MCP servers does not address this remote-server vulnerability.
Patch, then assume compromise.
Upgrade Visual Studio Code to version 1.145.3 or later. Version 1.145.3, released November 10, 2026, renders server-controlled elicitation messages as literal notification text and rejects non-string messages before elicitation processing. Both changes are required to address string-based command links and objects impersonating internal renderer structures. Install the update through Check for Updates or the official distribution channel, and verify the installed version in the About dialog.
No public exploits tracked yet. Mallory keeps watching.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.