Visual Studio Code: Information disclosure in GitHub Pull Requests extension

Summary

The GitHub Pull Requests and Issues extension for Visual Studio Code contains a flaw in which external control of file names or paths (CWE-73) allows information to be disclosed. An unauthorized attacker on the network can obtain information; according to Microsoft's impact note, this can include NetNTLMv2 hashes, which are authentication material in Windows networks. Exploitation requires user interaction (UI:R), and the attacker needs no privileges.

Affected

• Visual Studio Code, GitHub Pull Requests and Issues extension: versions 1.0.0 up to but excluding 1.145.3 (per CVE record)

Fixed in

• Version 1.145.3 is the first non-affected version according to the CVE record; verify this in the MSRC product table.
• The fix is delivered through a Visual Studio Code security update. Whether the extension can be updated separately is unknown.

Workaround

Unknown.

• If updating is delayed, disable the extension on systems where it is not needed (own suggestion, not from the vendor).

Exploitation

• Microsoft exploitability table (via Rapid7): Exploitation Less Likely, not publicly disclosed.
• CVSS vector includes E:U (unproven exploit maturity).
• Conflicting report: the Zero Day Initiative review states Microsoft marks it as exploited. This is unconfirmed; check MSRC directly.
• No public proof of concept found.
• CISA SSVC: exploitation none, not automatable.
• CISA KEV status: not verified.

Our recommendation

• Update Visual Studio Code and the GitHub Pull Requests and Issues extension to version 1.145.3 or later, prioritising developer machines that review external pull requests.
• Check MSRC directly for the exploitation status and the fixed version.
• Where updating is delayed, disable the extension on machines where it is not needed.
• Monitor developer workstations for unusual outbound authentication attempts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119976 msrc.microsoft.com
• CVE Record CVE-2026-119976 www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Zero Day Initiative: November 2026 security update review www.zerodayinitiative.com
• Strix: CVE-2026-119976 (third-party aggregator) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:06.