CVE-2026-81357: CWE-918: Server-Side Request Forgery (SSRF) in Microsoft Visual Studio Code

This vulnerability, identified as CWE-918 (Server-Side Request Forgery), exists in Microsoft Visual Studio Code and enables an unauthorized attacker to bypass security controls over a network. The CVSS 3.1 base score is 8.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability affects versions >=1.0.0 and <1.136.2. Microsoft has released an official fix to address this issue.

An attacker can exploit this SSRF vulnerability to bypass security features remotely, potentially gaining access to sensitive information (high confidentiality impact) and causing limited integrity issues. There is no impact on system availability. The vulnerability does not require privileges but does require user interaction. The scope of the vulnerability is changed, indicating that the attack can affect resources beyond the initially vulnerable component.

Microsoft has released an official fix for this vulnerability. Users should update Visual Studio Code to version 1.136.2 or later to remediate the issue. No additional mitigation steps are required beyond applying the official patch.