VS Code 1.145.3 fixes CVE-2026-120779: a malicious MCP server could turn an elicitation notification into a one-click command link
- Do now: update VS Code (and forks that track it) to 1.145.3 or later.
- Workaround from the advisory: connect only to trusted MCP servers and don't click links in notifications produced by a server you don't trust.
- Pattern (opinion): 'human approval' only works if the thing the human reads can't act on its own; MCP clients should treat all server-supplied text as untrusted display data.
Sources: GitHub advisory GHSA-66hq-jw93-462h (microsoft/vscode): Remote Code Execution via MCP Elicitation Notifications (Nov 10, 2026) · MSRC: CVE-2026-120779