---
title: VS Code 1.145.3 fixes CVE-2026-120779: a malicious MCP server could turn an elicitation notification into a one-click command link | ctxsec
url: https://ctxsec.com/items/vscode-cve-2026-120779-mcp-elicitation-notification-command-link-rce-1-145-3
description: "When an MCP server sends an elicitation request and no chat session is available, VS Code falls back to a regular notification. Before 1.145.3, the server-controlled message in that notification could be rendered as an interactive command link, so a user who connected to a malicious MCP server and clicked the link could run commands with their own permissions (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). The fix renders elicitation messages as literal text and validates the payload first."
status: "official (GitHub advisory GHSA-66hq-jw93-462h and MSRC CVE-2026-120779, Nov 10, 2026); not reported exploited"
published: 2026-11-12
---

> When an MCP server sends an elicitation request and no chat session is available, VS Code falls back to a regular notification. Before 1.145.3, the server-controlled message in that notification could be rendered as an interactive command link, so a user who connected to a malicious MCP server and clicked the link could run commands with their own permissions (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). The fix renders elicitation messages as literal text and validates the payload first.

[← Context & Harness Attacks](/context) · [markdown](/items/vscode-cve-2026-120779-mcp-elicitation-notification-command-link-rce-1-145-3.md)

official (GitHub advisory GHSA-66hq-jw93-462h and MSRC CVE-2026-120779, Nov 10, 2026); not reported exploited

2026-11-12 11:37 AM ET

### VS Code 1.145.3 fixes CVE-2026-120779: a malicious MCP server could turn an elicitation notification into a one-click command link

- **Do now:** update VS Code (and forks that track it) to 1.145.3 or later.
- **Workaround from the advisory:** connect only to trusted MCP servers and don't click links in notifications produced by a server you don't trust.
- **Pattern (opinion):** 'human approval' only works if the thing the human reads can't act on its own; MCP clients should treat all server-supplied text as untrusted display data.

Sources: [GitHub advisory GHSA-66hq-jw93-462h (microsoft/vscode): Remote Code Execution via MCP Elicitation Notifications (Nov 10, 2026)](https://github.com/microsoft/vscode/security/advisories/GHSA-66hq-jw93-462h) · [MSRC: CVE-2026-120779](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120779)