CVE-2026-81380: 
Visual Studio Code vulnerability analysis and mitigation

CVE-2026-81380 is a command injection vulnerability (CWE-77) affecting GitHub Copilot and Visual Studio Code that allows an unauthorized network attacker to disclose sensitive information. The vulnerability was disclosed on September 8, 2026, as part of Microsoft's September 2026 Patch Tuesday. Affected versions of Visual Studio Code include 1.0.0 through versions prior to 1.136.2. It carries a CVSS v3.1 base score of 5.3 (Medium severity) (MSRC Advisory, GitHub Advisory).

The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), where GitHub Copilot and Visual Studio Code fail to properly sanitize externally-influenced input before incorporating it into a command. This allows an attacker to inject special elements that modify the intended command behavior, resulting in information disclosure. Exploitation requires network access and user interaction, and the attack complexity is rated High, indicating that specific conditions must be met for successful exploitation (MSRC Advisory, GitHub Advisory).

Successful exploitation of this vulnerability results in the disclosure of sensitive information from affected systems over a network. The impact is limited to confidentiality — there is no integrity or availability impact. An unauthenticated attacker can trigger the vulnerability remotely, but user interaction is required, limiting the scope of opportunistic exploitation (MSRC Advisory, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable (GitHub Advisory, MSRC Advisory).

Microsoft has released a patch addressing this vulnerability; users should update Visual Studio Code to version 1.136.2 or later. The patch is available via the Microsoft Security Response Center and the GitHub Advisory Database. Users are advised to apply the update as soon as possible through the standard VS Code update mechanism or by downloading the patched release directly (MSRC Advisory, GitHub Advisory, VS Code Release).

The vulnerability was covered as part of broader September 2026 Patch Tuesday reporting. Security outlets including BleepingComputer, Zero Day Initiative, and Rapid7 included it in their Patch Tuesday roundups, though it did not receive significant individual attention given its medium severity and lack of active exploitation (BleepingComputer, ZDI, Rapid7).