Skip to content

Azure DevOps access token disclosure through GitHub Copilot Chat workspace settings

Moderate
vritant24 published GHSA-rvgr-2w56-2j67 Sep 8, 2026

Package

Visual Studio Code (Ecosystem)

Affected versions

< 1.136.2

Patched versions

1.136.2

Description

Impact

An information disclosure vulnerability in the GitHub Copilot Chat extension for Visual Studio Code could expose a user's Azure DevOps (ADO) access token.

The ADO Code Search integration allowed its endpoint URL to be overridden through workspace configuration. A malicious repository could include a .vscode/settings.json file that redirects ADO Code Search requests to an attacker-controlled server. When an authenticated ADO Code Search request is made using that configuration, the user's access token could be sent to the attacker-controlled endpoint.

The disclosed token could allow an attacker to access data and services that the user is authorized to use, potentially including sensitive organizational information.

Patches

The fix is available starting with Visual Studio Code 1.136.2.

The fix (f94e10b) removes the configurable ADO Code Search endpoint override, including the github.copilot.chat.workspace.prototypeAdoCodeSearchEndpointOverride setting and its legacy github.copilot.chat.advanced.workspace.prototypeAdoCodeSearchEndpointOverride equivalent.

ADO Code Search now derives its endpoint using the standard Azure DevOps URL construction rather than a workspace-controlled override.

Users should update to Visual Studio Code 1.136.2 or later.

Workarounds

There are no known workarounds. Users should update to Visual Studio Code 1.136.2 or later.

References

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVE ID

CVE-2026-81381

Weaknesses

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. Learn more on MITRE.