← News
/DISPATCH · 2026-08-15

CVE-2026-70336: VS Code 1.133 Patches RCE; GitHub Copilot Agent Mode Command Injection Disclosed

Microsoft August Patch Tuesday patched VS Code RCE CVE-2026-70336 and GitHub Copilot agent-mode command injection CVE-2026-70335. All VS Code 1.132 and earlier are affected. Developer workstations are high-value credential stores.

CVE-2026-70336 is a VS Code remote code execution bug patched on Microsoft August Patch Tuesday. CVSS 7.8. Unauthenticated network attackers execute arbitrary code in the VS Code process context. Same-day CVE-2026-70335 hits GitHub Copilot agent mode and VS Code agent mode. Attackers plant prompt injections in PR descriptions, READMEs, web pages, or MCP tool responses and trigger Copilot to silently run OS commands. CVSS 7.8. Both fixed in VS Code 1.133, shipped 12 August. All 1.132 and earlier are affected.

Incident Overview

Microsoft shipped VS Code 1.133 on 12 August, patching CVE-2026-70336 and CVE-2026-70335. Qualys and ZDI ranked both the top developer-tool risk of August Patch Tuesday. Every developer machine on VS Code 1.132 or earlier is in scope. GitHub Copilot and GitHub Copilot Chat extensions must be upgraded separately. They ship on independent cadences; updating the VS Code host does not guarantee a patched Copilot build. Microsoft patched 421 CVEs this Patch Tuesday, 62 Critical. Developer tools accounted for 26 fixes — one of the densest monthly developer-tool security updates.

Technical Details

CVE-2026-70336 is network-vector. The bug lives in the VS Code process itself, not an extension. Exposure equals every unpatched VS Code install. No physical access required. Arbitrary code runs in the VS Code process context over the network.

CVE-2026-70335 is CWE-78 OS command injection. Attackers embed malicious instructions in content the Copilot agent processes: repo READMEs, source comments in PRs, pages Copilot fetches, or MCP tool responses. When the user asks Copilot to handle that content, injected instructions execute OS commands with no confirmation dialog. No credentials required.

Not isolated. CVE-2025-53773 in 2025 showed Copilot can be weaponized as a worm. CVE-2026-70335 is the OS command-injection variant. Microsoft tied both bugs to agent mode: auto-browse, auto-execute, auto-invoke tools. Prompt injection works because Copilot is built for broad read access and wide privileges.

Impact

A developer workstation is a denser credential store than a typical server. One VS Code box often holds SSH keys, AWS/GCP/Azure CLI sessions, GitHub tokens, CI/CD service-account tokens, and browser sessions logged into deploy consoles. Qualys August Patch Tuesday analysis: a compromised developer machine becomes a software-supply-chain foothold. Attackers steal repo tokens, modify source, or lift CI/CD credentials. The March 2026 LiteLLM supply-chain incident (2,500 organizations, 434,000 CI/CD pipelines) started with developer-environment credential theft. CVSS 7.8 plus remote vector makes this a high-priority patch this week.

Remediation

References