al-ice.ai

Malicious VS Code Workspaces Could Redirect Copilot Tokens — CVE-2026-47282

AI CVEs by al-ice.ai Editorial

A Visual Studio Code workspace could carry hidden GitHub Copilot endpoint overrides that redirected authenticated Copilot traffic to an attacker-controlled server. Opening the workspace was enough to place those settings inside the editor’s configuration chain; the victim did not have to copy a token or approve its disclosure.

The flaw is tracked as CVE-2026-47282 and GHSA-wr9x-42j2-jvh3. It affects VS Code through 1.128.0 and is fixed in 1.128.1. Microsoft’s CVE record assigns a 6.5 Medium CVSS 3.1 score, while GitHub labels the repository advisory High. Both describe an information-disclosure boundary: an unauthenticated network attacker still needs the user to open a crafted workspace, but a successful path can expose a Copilot credential.

The repository advisory says the token has a 30-minute lifetime. That limits persistence, not the significance of the leak. A token sent to an untrusted upstream can be used during its validity window, and the surrounding workspace may contain the attacker’s next-stage instructions. The defensive priority is therefore to patch the editor and treat workspace configuration as executable security policy, not harmless project metadata.

The workspace controlled where Copilot authenticated

VS Code supports settings at several scopes: user, workspace, and folder. That hierarchy is convenient for formatting and build preferences, but endpoint and proxy overrides are materially different. If a repository can choose the service receiving an authenticated request, it can turn a project setting into a credential-routing primitive.

According to the VS Code advisory, a malicious .vscode/settings.json could contain hidden advanced Copilot settings and cause the short-lived token to be sent to a malicious upstream server. The vulnerable values included internal override keys for Copilot API and proxy URLs. The attack therefore crossed two boundaries at once: repository content influenced application-wide networking, and a developer credential followed that untrusted routing decision.

This is not the same as a prompt injection persuading an agent to print a secret. The vulnerable behavior occurred in the editor’s configuration and request path. Model safeguards, refusal training, and tool-call confirmation would not repair a client that was already sending authentication material to the wrong endpoint.

Version 1.128.1 moves sensitive overrides out of workspace control

The patch marks security-sensitive Copilot API and proxy override keys as userScopeOnly. VS Code now reads their global user values and ignores workspace or folder values. The change covers current, legacy, and test variants of the CAPI and proxy URL overrides, rather than blocking only one disclosed spelling.

That design is stronger than asking whether the supplied URL “looks safe.” A workspace has no legitimate need to redirect the user’s authenticated Copilot client, so the patch removes that authority from the project scope entirely. It also handles both flat advanced-setting keys and object-style settings while selecting only the global value.

The official 1.128 release notes point users to the 1.128.1 security update, and the public fix landed under commit f05bcd1a. Version inventory should compare the running desktop build—not merely a centrally approved package version—because gradual update rollouts and long-lived developer sessions can leave individual clients behind.

Why a short-lived token still matters

Short expiration is valuable containment, but it is not a substitute for correct destination binding. An attacker who receives a live token can act immediately, and incident responders may have little time to distinguish malicious use from ordinary Copilot traffic. The advisory does not claim that the token grants arbitrary GitHub account access, so defenders should avoid inflating the scope beyond the credential and services involved. They should also avoid dismissing it merely because the token expires.

The broader supply-chain pattern is familiar: repositories now carry configuration for editors, agents, MCP servers, task runners, dev containers, CI workflows, and extensions. Cloning content is no longer a passive read. Every file that can select an executable, endpoint, hook, environment variable, tool server, or trust exception belongs in the repository threat model.

That same lesson appears in prior attacks involving repository configuration aimed at AI coding agents and untrusted repository text steering coding assistants toward credential theft. CVE-2026-47282 is narrower, but more deterministic: the sensitive routing decision lived in configuration rather than in a model’s interpretation.

Defensive engineering guidance

  • Update VS Code to 1.128.1 or later. Confirm the version on developer endpoints and ephemeral workstations instead of relying only on package-management policy.
  • Inspect workspaces before first open. On systems that cannot yet update, review .vscode/settings.json and related workspace files with external tooling. Look specifically for Copilot advanced API or proxy URL overrides.
  • Hunt for unexpected Copilot destinations. Review DNS, proxy, endpoint, and firewall telemetry for developer machines sending Copilot-related authenticated traffic to domains outside approved GitHub and enterprise endpoints.
  • Treat a suspicious open as a credential event. Preserve the workspace, process and network telemetry, identify when it was opened, and determine whether an unapproved upstream received requests during the token’s validity window.
  • Reduce repository-config authority. Inventory editor tasks, extension recommendations, dev-container hooks, MCP definitions, agent instructions, and workspace settings. Apply allowlists or review gates where those files can select code or network destinations.
  • Keep secrets out of agent context. Patch the client boundary, then reinforce it with short-lived credentials, least privilege, outbound network controls, and isolation between untrusted repositories and high-value developer identities.

CVE-2026-47282 is a reminder that AI-assistant security starts before the prompt. The destination receiving an agent’s authenticated request is as consequential as the action the model chooses. Project-scoped convenience must stop where user-scoped identity begins.

Sources: