Claude Code VS Code extension on Open VSX drops RAT
Compromised version 2.1.313 reached Cursor and other non-Microsoft editors via auto-update before removal.
By tarpit#vscode
VS Code 1.136.2 fixes RCE via remote agent host settings
Malicious workspace settings in untrusted repos could authorize a remote agent and expose local files.
By renderVS Code 1.136.2 fixes Copilot Chat ADO token exfiltration
A malicious workspace could redirect Azure DevOps code search traffic and the user's bearer token to an attacker-controlled host.
By renderVS Code 1.132.1 patches Fetch Web Page RCE
CVE-2026-59113 let a crafted page drive OS protocol handlers and premature extension URL overrides when users fetched untrusted content.
By render