CVE-2026-120779

A remote MCP notification could run code in the editor user's context

Microsoft · Visual Studio Code remote MCP notifications

First documented disclosure · Review checkpoint

Summary

The editor handled an untrusted server notification as an action with local authority. Code could run with the user’s local permissions.

Severity and exploitation evidence

Critical · 9.6/10 · CVSS 3.1. Severity source.

Exploitation not established: Microsoft marked exploitation as No at publication.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The editor handled an untrusted server notification as an action with local authority.

Conditions required

A user connected to an attacker-controlled remote MCP server and clicked its notification link.

Potential impact

Code could run with the user’s local permissions.

Affected versions and configurations

1.0.0 through versions before 1.145.3, per Microsoft.

Fix and mitigation status

1.145.3.

Practical next steps

Update VS Code and review which remote MCP servers users have authorized.

Operating lesson

Track the deployed SDK, extension or managed service when applying Microsoft’s remediation.

Evidence and limits

The CVE record was published on 2026-11-10.

Sources