Microsoft has released Visual Studio Code 1.145.3, a security patch that addresses 17 vulnerabilities, particularly focusing on the AI-agent attack surface, which includes remote code execution issues. Among the critical fixes is a JS debugger auto-attach flaw that could allow malicious code to run without user interaction, highlighting the need for users to be cautious with untrusted folders. The patch also includes fixes for configuration parsing issues and cross-site command injection vulnerabilities linked to the extension marketplace. Users are advised to update to version 1.145.3 or later and exercise caution with untrusted links and folders, especially in enterprise environments

Visual Studio Code 1.145.3 Security Patch Covering 17 Vulnerabilities

Microsoft has shipped VS Code 1.145.3, a security-only patch covering 17 vulnerabilities, all of which were fixed on November 10, 2026. The biggest theme is the AI-agent attack surface, with six of the fixes addressing remote code execution holes in MCP integrations, the integrated browser and agent command execution. The most alarming is a JS debugger auto-attach flaw that lets a malicious folder run code with zero user interaction. Microsoft says the fix is already out, so updating to 1.145.3 or later is the obvious move.

Visual Studio Code 1.145.3 Security Patch Covering 17 Vulnerabilities @ NT Compatible