Skip to content

CVE-2026-21518: Verified Reproduction

CVE-2026-21518: cve-2026-21518

Download script Open in Codespaces

CVE-2026-21518 is verified against the affected target. This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00118.

REPRO-2026-00118 Feb 21, 2026 CVE entry .txt
Severity
HIGH
CVSS
8.8
Reproduced in
40m 34s
Tool calls
276
Spend
$7.58
01 · Overview

What Is CVE-2026-21518?

CVE-2026-21518 is a medium-severity vulnerability in VS Code / GitHub Copilot where MCP server definitions in workspace settings could start without workspace trust. Pruva reproduced it (reproduction REPRO-2026-00118).

02 · Severity & CVSS

CVE-2026-21518 Severity & CVSS Score

CVE-2026-21518 is rated high severity, with a CVSS base score of 8.8 out of 10.

HIGH threat level
8.8 / 10 CVSS base
Weakness CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection')

High — serious impact or readily exploitable. Prioritize remediation.

05 · How to Reproduce
Download script Open in Codespaces →

How to Reproduce CVE-2026-21518

$ pruva-verify REPRO-2026-00118
or curl -O https://www.pruva.dev/api/v1/reproductions/REPRO-2026-00118/artifacts/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
06 · Proof of Reproduction

Proof of Reproduction for CVE-2026-21518

Reproduced by Pruva's autonomous agents — 276 tool calls over 41 min. Full root-cause analysis and the complete transcript are below.

Runnable proof: reproduction_steps.sh
Captured evidence: vulnerable run
How the agent worked 679 events · 276 tool calls · 41 min
41 minDuration
276Tool calls
124Reasoning steps
679Events
2Dead-ends
Agent activity over 41 min
Support
8
Repro
347
Variant
320
0:0040:34

Root Cause and Exploit Chain for CVE-2026-21518

Versions: prior to 1.109.1 (fix commit cd11faec7b031b928bc5ec37f350d623ffb28713)
  • Affected versions: prior to 1.109.1 (fix commit cd11faec7b031b928bc5ec37f350d623ffb28713)
  • Risk level and consequences: Medium. Opening an untrusted repository could start an attacker-controlled MCP server and execute its configured command, bypassing the workspace trust barrier.

Root Cause

The _checkTrust path did not gate workspace-scoped MCP collections on workspace trust. As a result, resolveConnection() proceeded to launch even when the workspace was untrusted, allowing execution of the MCP server command. The fix adds a StorageScope.WORKSPACE trust check via IWorkspaceTrustManagementService and IWorkspaceTrustRequestService before running trust logic for MCP servers.

Fix commit: cd11faec7b031b928bc5ec37f350d623ffb28713

Reproduction Steps

  1. Run repro/reproduction_steps.sh.
  2. The script installs build dependencies, bundles a TypeScript harness that exercises McpRegistry.resolveConnection() with a workspace-scoped MCP collection, and runs it against the vulnerable and fixed commits.
  3. Expected evidence: the vulnerable run reports “workspace-scoped server started without trust”, while the patched run reports “workspace trust check blocked connection”.

Evidence

  • Logs: logs/vulnerable_run.log, logs/patched_run.log, logs/summary.log, logs/esbuild.log
  • Key excerpts:
    • logs/vulnerable_run.log: “Vulnerable behavior observed: workspace-scoped server started without trust.”
    • logs/patched_run.log: “Patched behavior observed: workspace trust check blocked connection.”
  • Environment: Node.js + npm with local esbuild bundling of the VS Code TypeScript sources.

Recommendations / Next Steps

  • Keep the workspace trust gate in McpRegistry._checkTrust for all StorageScope.WORKSPACE collections.
  • Ensure release versions include commit cd11faec7b031b928bc5ec37f350d623ffb28713 (1.109.1 or later).
  • Add/extend automated tests for workspace trust gating of MCP server launch paths.

Additional Notes

  • Idempotency: repro/reproduction_steps.sh was run twice successfully with identical outputs.
  • Limitation: The harness uses test services to exercise the MCP registry logic directly rather than spinning up a full VS Code UI, but executes the real vulnerable code path from the repository.

CVE-2026-21518 Reproduction Transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Full session Replay every step — scrub the timeline or play it back.

Event 1/40
0:003:04
0:00
session startedgpt-5.2-codex · cve-2026-21518 · cve-2026
0:08
0:10
web search
0:23
0:23
extract_facts
no facts extracted
0:25
0:25
supportrepro
0:44
0:44
0:48
0:48
$pwd
✓
/root/.pruva/runs/cve-2026-21518_20260221-080904
1:16
$git clone --depth=200 https://github.com/microsoft/vscode.git /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode
26.2s✓
{"cwd":"/root/.pruva/runs/cve-2026-21518_20260221-080904","duration_ms":26162,"exit_code":0,"stderr":"Cloning into '/root/.pruva/runs/cve-2026-21518_20260221-080904/vscode'...\nUpdating files:  27% (2574/9510)\rUpdating files:  28% (2663/9510)\rUpdating files:  29% (2758/9510)\rUpdating files:  30% (2853/9510)\rUpdating files:  31% (2949/9510)\rUpdating files:  32% (3044/9510)\rUpdating files:  33% (3139/9510)\rUpdating files:  34% (3234/9510)\rUpdating files:  35% (3329/9510)\rUpdating files:  36% (3424/9510)\rUpdating files:  37% (3519/9510)\rUpdating files:  38% (3614/9510)\rUpdating files:  39% (3709/9510)\rUpdating files:  40% (3804/9510)\rUpdating files:  41% (3900/9510)\rUpdating files:  42% (3995/9510)\rUpdating files:  43% (4090/9510)\rUpdating files:  44% (4185/9510)\rUpdating files:  45% (4280/9510)\rUpdating files:  46% (4375/9510)\rUpdating files:  47% (4470/9510)\rUpdating files:  48% (4565/9510)\rUpdating files:  48% (4570/9510)\rUpdating files:  49% (4660/9510)\rUpdating files:  50% (4755/9510)\rUpdating files:  51% (4851/9510)\rUpdating files:  52% (4946/9510)\rUpdating files:  53% (5041/9510)\rUpdating files:  54% (5136/9510)\rUpdating files:  55% (5231/9510)\rUpd… [truncated]
1:18
$git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode log --all --oneline --grep="CVE-2026-21518" | head -n 5
0.3s✓
1:20
$git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode log --all --oneline --grep="cd11faec7b031b928bc5ec37f350d623ffb28713" | head -n 5
0.3s✓
1:22
$git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode cat-file -t cd11faec7b031b928bc5ec37f350d623ffb28713
✓
fatal: git cat-file: could not get object info
1:24
$git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode tag --list "1.109.*" | head -n 20
✓
1:25
$git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode rev-parse HEAD
✓
6e91d50e716e10d08f69dab525b801e9cfa022c7
1:30
2:58
$git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode fetch --depth=500 origin cd11faec7b031b928bc5ec37f350d623ffb28713
88.2s✓
From https://github.com/microsoft/vscode
 * branch                    cd11faec7b031b928bc5ec37f350d623ffb28713 -> FETCH_HEAD
3:00
$git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode cat-file -t cd11faec7b031b928bc5ec37f350d623ffb28713
✓
commit
3:01
$git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode show cd11faec7b031b928bc5ec37f350d623ffb28713 --stat
✓
commit cd11faec7b031b928bc5ec37f350d623ffb28713
Author: Johannes Rieken <jrieken@microsoft.com>
Date:   Mon Feb 9 08:38:37 2026 +0100

    CVE-2026-21518 (MSRC#106249) (#32)
    
    * strings: add a punycode encoding function
3:04
3:04
08 · How to Fix

How to Fix CVE-2026-21518

Coming soon

Step-by-step mitigation and hardening guidance for CVE-2026-21518 — configuration checks, workarounds where no patch exists, and how to verify you're protected — is on the way.

10 · FAQ

FAQ: CVE-2026-21518

How does the CVE-2026-21518 attack work?

An attacker plants a malicious .vscode/settings.json in a repository or workspace defining an MCP server. When a victim opens that workspace without granting workspace trust, VS Code / GitHub Copilot could still start the defined MCP server, resulting in command execution.

How severe is CVE-2026-21518?

It is rated medium severity, requiring a victim to open an untrusted workspace containing an attacker-controlled .vscode/settings.json.

How can I reproduce CVE-2026-21518?

Download the verified script from this page and run it in an isolated environment against an affected VS Code / GitHub Copilot build. It opens a workspace containing a malicious .vscode/settings.json defining an MCP server without granting workspace trust, and shows the MCP server starting anyway; the fix adds workspace trust checks and punycode encoding for domain normalization before allowing MCP servers to start.
11 · References

References for CVE-2026-21518

Authoritative sources for CVE-2026-21518 — official vulnerability databases and the upstream advisory. Pruva's reproduction verifies the issue firsthand; these are the primary records to corroborate it.