VS Code 1.132.1 patches Fetch Web Page RCE

Microsoft has fixed a remote code execution vulnerability in Visual Studio Code's Fetch Web Page tool that affected version 1.132.0 and earlier. When the tool retrieved a maliciously crafted page, a hidden web content loader could launch operating-system protocol handlers without an extra prompt, including through window opens and navigation in untrusted frames. Extension URL overrides could also run before URI trust approval finished. With user interaction to fetch the page, an attacker could execute code on the local system.

The flaw is tracked as CVE-2026-59113. VS Code 1.132.1 blocks window creation from fetched content, stops untrusted frame and custom-protocol navigation, enforces URL policy on web requests, and runs extension URL overrides only after trust approval. Until the update is installed, Microsoft advises against using Fetch Web Page on untrusted sources.