PulseAugur
EN
LIVE 03:47:15

VS Code vulnerability allowed Copilot to execute commands without approval · 1 source tracked

By PulseAugur Editorial · [1 sources] ·

A security vulnerability in VS Code versions prior to 1.141.1 allowed the Copilot agent to modify hook files without user approval. This could lead to the execution of malicious shell commands with user privileges if an attacker influenced the agent through prompt injection. The issue, identified as CVE-2026-102232, affected custom hook and agent-definition locations configured via specific settings. The fix, released in VS Code 1.141.1, now requires confirmation for direct writes to these sensitive locations. AI

IMPACT This vulnerability highlights the risks of AI agents executing code without explicit user confirmation, emphasizing the need for robust security measures in development tools.

RANK_REASON Security advisory for a specific software version and its agent.

Read on dev.to — Claude Code tag →

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →

VS Code vulnerability allowed Copilot to execute commands without approval · 1 source tracked

How we ranked this

Signal score
26 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
Security advisory for a specific software version and its agent.
Source corroboration
Single-source cluster
Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
Breaking (< 6h)
Fresh story with cross-source coverage still developing. Ranking may shift as more sources report.

Full methodology in our editorial standards.

COVERAGE [1]

  1. dev.to — Claude Code tag TIER_1 English(EN) · Rulestack ·

    VS Code 1.141.0 let Copilot edit hook files with no prompt. Claude Code's default mode prompts for .claude/ writes

    <blockquote> <p>On 2026-10-13 the VS Code team published an advisory for CVE-2026-102232: in VS Code 1.141.0 and earlier, the Copilot agent could edit hook files in custom hook locations without the approval prompt, so content the agent read could get it to add a shell command th…

RELATED ENTITIES

RELATED TOPICS