Impact
A security feature bypass vulnerability existed in VS Code builds up to and including version 1.136.1 when agent network filtering used dotted IPv4 literals in a deny list. An equivalent IPv4-mapped IPv6 literal normalized to a different string and did not match the configured IPv4 entry. In a deny-only configuration, the unmatched destination was allowed. An attacker able to influence a URL accessed by an agent network tool could use an alternate address representation to reach an endpoint that an administrator intended to block.
The affected configuration required chat.agent.networkFilter to be enabled, at least one IPv4 literal in chat.agent.deniedNetworkDomains, and an empty chat.agent.allowedNetworkDomains list.
Patches
The fix (8a19bab) is is available in VS Code builds starting with 1.136.2. The fix compares dotted IPv4 addresses with equivalent IPv4-mapped and IPv4-compatible IPv6 literals using a shared IPv4 representation, including for wildcard-prefixed IPv4 patterns, while preserving distinct IPv6 unspecified and loopback addresses. Regression tests cover alternate mapped spellings, deny-only policy behavior, and blocked requests before web content extraction.
Workarounds
Use an explicit, non-empty chat.agent.allowedNetworkDomains allow list instead of relying on a deny-only configuration. Alternatively, disable agent tools that can access network resources until a build containing the fix is installed.
References
Impact
A security feature bypass vulnerability existed in VS Code builds up to and including version 1.136.1 when agent network filtering used dotted IPv4 literals in a deny list. An equivalent IPv4-mapped IPv6 literal normalized to a different string and did not match the configured IPv4 entry. In a deny-only configuration, the unmatched destination was allowed. An attacker able to influence a URL accessed by an agent network tool could use an alternate address representation to reach an endpoint that an administrator intended to block.
The affected configuration required
chat.agent.networkFilterto be enabled, at least one IPv4 literal inchat.agent.deniedNetworkDomains, and an emptychat.agent.allowedNetworkDomainslist.Patches
The fix (8a19bab) is is available in VS Code builds starting with 1.136.2. The fix compares dotted IPv4 addresses with equivalent IPv4-mapped and IPv4-compatible IPv6 literals using a shared IPv4 representation, including for wildcard-prefixed IPv4 patterns, while preserving distinct IPv6 unspecified and loopback addresses. Regression tests cover alternate mapped spellings, deny-only policy behavior, and blocked requests before web content extraction.
Workarounds
Use an explicit, non-empty
chat.agent.allowedNetworkDomainsallow list instead of relying on a deny-only configuration. Alternatively, disable agent tools that can access network resources until a build containing the fix is installed.References