{"slug": "patch-now-vs-code-cve-2026-70336-rce-this-week", "title": "Patch Now: VS Code CVE-2026-70336 RCE This Week", "summary": "Microsoft's August 2026 Patch Tuesday fixed 421 CVEs, including two critical vulnerabilities affecting Visual Studio Code: CVE-2026-70336 enables remote code execution in VS Code, and CVE-2026-70335 allows OS command injection via GitHub Copilot and VS Code's agent mode. Users must update to VS Code 1.133, released August 12, to mitigate the risks, as developer workstations are prime targets for credential theft and supply-chain attacks.", "body_md": "Microsoft’s August 2026 Patch Tuesday fixed [421 CVEs](https://www.securityweek.com/august-2026-patch-tuesday-microsoft-fixes-421-cves-one-exploited-zero-day/) — but this is not a batch you can hand off to the sysadmin team and forget about. Two of those patches target tools you likely have open in another window right now: CVE-2026-70336 enables remote code execution in Visual Studio Code, and CVE-2026-70335 lets an attacker escalate privileges through GitHub Copilot and VS Code’s agent mode via OS command injection. If you’re not on [VS Code 1.133](https://code.visualstudio.com/updates/v1_133) — released August 12 — your IDE is vulnerable.\n\n## Two CVEs, One Common Thread\n\nCVE-2026-70336 is straightforward in the worst possible way: a remote attacker can execute arbitrary code in the context of the VS Code process. The attack vector is network-based. No physical access needed. The vulnerability is present in the VS Code application itself, not a specific extension, which means the exposure is broad — every developer who runs VS Code and hasn’t updated this week is affected.\n\n[CVE-2026-70335](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70335) is trickier and more interesting. It’s classified as CWE-78 — OS command injection — in GitHub Copilot and VS Code’s agent mode. The attack scenario: an adversary embeds malicious instructions inside content that Copilot’s agent will process. That content could be a repository README, a source comment in a PR they’ve submitted, a webpage Copilot browses, or a response from a connected MCP tool. When you ask Copilot’s agent to work with that content, the injected instructions cause it to execute OS commands on your machine — without prompting for confirmation. No authentication required from the attacker. They just need to get their content somewhere your agent will read it.\n\nThis attack class was [documented in 2025](https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/) with CVE-2025-53773, which showed Copilot could be weaponized as a worm through specially crafted repository files. CVE-2026-70335 is the OS command injection variant. The threat model is not theoretical — it has a year of published research behind it.\n\n## Why Your Workstation Is the Interesting Target\n\nEnterprise security briefings spend most of their Patch Tuesday energy on Windows Server, Active Directory, and Exchange. That framing misses something important: developer workstations are a denser credential store than most servers. A typical developer machine running VS Code right now probably has:\n\n- SSH keys with access to production infrastructure\n- Active cloud CLI sessions (AWS, GCP, Azure) with admin-level permissions\n- GitHub tokens in\n`~/.gitconfig`\n\nor environment variables - API keys scattered across\n`.env`\n\nfiles in open project directories - CI/CD service account tokens\n- A browser session authenticated to your company’s deployment dashboard\n\nCompromise a developer machine and you don’t just get their files — you get a credentialed foothold across every system that developer touches. The LiteLLM supply chain breach in March 2026 — which affected over 2,500 organizations and [434,000 CI/CD pipelines](https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines) — started with credential theft from developer environments. Qualys put it plainly in their August Patch Tuesday analysis: “Compromise of a developer endpoint can become a software supply-chain risk if attackers obtain repository tokens, modify source code, or steal credentials used in CI/CD systems.”\n\n## How to Patch VS Code CVE-2026-70336 Now\n\nFor CVE-2026-70336 and CVE-2026-70335, the fix is VS Code 1.133 combined with the latest GitHub Copilot extension update.\n\nCheck your current version:\n\n```\ncode --version\n```\n\nIf you’re below 1.133, update immediately:\n\n**In VS Code:** Help → Check for Updates**macOS (Homebrew):**`brew upgrade --cask visual-studio-code`\n\n**Linux (apt):**`sudo apt update && sudo apt upgrade code`\n\nAfter updating VS Code, open the Extensions panel and update the GitHub Copilot and GitHub Copilot Chat extensions separately. The extensions ship on their own release cadence and the VS Code update alone does not guarantee you get the patched Copilot version.\n\n## Beyond the Headline CVEs: 26 Developer Tool Fixes This Month\n\nCVE-2026-70336 and CVE-2026-70335 are the headliners, but August Patch Tuesday includes 26 total fixes across Microsoft’s Developer Tools category. These cover Visual Studio (the full IDE), .NET Framework 8.0 and 9.0, and Azure DevOps tooling. If your team runs internal CI/CD infrastructure on Microsoft’s stack, this month’s update is broader than a routine patch cycle — it warrants verification across your build environment.\n\nThe sheer volume — 421 CVEs in a single patch release — is notable. Microsoft attributes it to AI-assisted vulnerability research surfacing issues faster than before. That’s not reassuring: it suggests the pace of discovery (and therefore patching) is only going to accelerate.\n\n## Agent Mode Is the New Attack Surface\n\nCVE-2026-70335 is worth sitting with for a moment. Copilot’s agent mode is useful precisely because it reads broadly and acts autonomously. It browses, executes, reads files, calls tools. The same capabilities that make it productive are what make prompt injection exploitable. When a developer disables terminal confirmation prompts to speed up their workflow — a common configuration — they remove the last guardrail between untrusted content and OS command execution.\n\nThis isn’t a reason to stop using AI coding tools. It’s a reason to treat them with the same security discipline as any other tool that processes external input. Don’t run Copilot agent mode against untrusted repositories without reviewing what it’s about to read. Treat MCP tool outputs as untrusted input. Keep confirmation dialogs enabled.\n\nMoreover, more CVEs in this category are coming. CVE-2025-53773 and CVE-2026-70335 aren’t isolated incidents — they’re the first instances of a vulnerability class that will persist as long as AI agents operate with broad OS permissions on developer workstations. Patching 1.133 is the immediate fix. Understanding why this vulnerability class exists is the long-term one.", "url": "https://wpnews.pro/news/patch-now-vs-code-cve-2026-70336-rce-this-week", "canonical_source": "https://byteiota.com/patch-now-vs-code-cve-2026-70336-rce-this-week/", "published_at": "2026-08-14 05:11:01+00:00", "updated_at": "2026-08-14 05:34:49.376331+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy", "ai-tools", "ai-agents"], "entities": ["Microsoft", "Visual Studio Code", "GitHub Copilot", "Qualys", "LiteLLM", "CVE-2026-70336", "CVE-2026-70335"], "alternates": {"html": "https://wpnews.pro/news/patch-now-vs-code-cve-2026-70336-rce-this-week", "markdown": "https://wpnews.pro/news/patch-now-vs-code-cve-2026-70336-rce-this-week.md", "text": "https://wpnews.pro/news/patch-now-vs-code-cve-2026-70336-rce-this-week.txt", "jsonld": "https://wpnews.pro/news/patch-now-vs-code-cve-2026-70336-rce-this-week.jsonld"}}