CVE-2026-21518: Verified Repro With Script Download

CVE-2026-21518: cve-2026-21518

Download script Open in Codespaces

CVE-2026-21518 is verified against the affected target. This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00118.

REPRO-2026-00118 Feb 21, 2026 CVE entry ↗ .txt

Severity

HIGH

CVSS

8.8

Reproduced in

40m 34s

Tool calls

276

Spend

$7.58

What Is CVE-2026-21518?

CVE-2026-21518 is a medium-severity vulnerability in VS Code / GitHub Copilot where MCP server definitions in workspace settings could start without workspace trust. Pruva reproduced it (reproduction REPRO-2026-00118).

02 · Severity & CVSS

CVE-2026-21518 Severity & CVSS Score

CVE-2026-21518 is rated high severity, with a CVSS base score of 8.8 out of 10.

HIGH threat level

8.8 / 10 CVSS base

Weakness CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection')

High — serious impact or readily exploitable. Prioritize remediation.

05 · How to Reproduce

Download script Open in Codespaces →

$ pruva-verify REPRO-2026-00118

or

curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00118/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh

Run in a VM or disposable container. This exploits a real vulnerability.

06 · Proof of Reproduction

Proof of Reproduction for CVE-2026-21518

Reproduced by Pruva's autonomous agents — 276 tool calls over 41 min. Full root-cause analysis and the complete transcript are below.

How the agent worked 679 events · 276 tool calls · 41 min

41 minDuration

276Tool calls

124Reasoning steps

679Events

2Dead-ends

Agent activity over 41 min

Support

8

Repro

347

Variant

320

0:0040:34

Root Cause and Exploit Chain for CVE-2026-21518

VS Code/GitHub Copilot MCP server definitions in workspace settings could start without workspace trust, enabling command execution via malicious .vscode/settings.json; fixed by adding workspace trust checks and punycode encoding for domain normalization.

CVE-2026-21518 Reproduction Transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Full session Replay every step — scrub the timeline or play it back.

Event 1/40

0:00

support

repro

3:04

0:00

session startedgpt-5.2-codex · cve-2026-21518 · cve-2026

0:08

0:10

web search

0:23

0:23

extract_facts

no facts extracted

0:25

0:25

supportrepro

0:44

0:44

0:48

0:48

$pwd

✓

/root/.pruva/runs/cve-2026-21518_20260221-080904

1:16

$git clone --depth=200 https://github.com/microsoft/vscode.git /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode

26.2s✓

{"cwd":"/root/.pruva/runs/cve-2026-21518_20260221-080904","duration_ms":26162,"exit_code":0,"stderr":"Cloning into '/root/.pruva/runs/cve-2026-21518_20260221-080904/vscode'...\nUpdating files:  27% (2574/9510)\rUpdating files:  28% (2663/9510)\rUpdating files:  29% (2758/9510)\rUpdating files:  30% (2853/9510)\rUpdating files:  31% (2949/9510)\rUpdating files:  32% (3044/9510)\rUpdating files:  33% (3139/9510)\rUpdating files:  34% (3234/9510)\rUpdating files:  35% (3329/9510)\rUpdating files:  36% (3424/9510)\rUpdating files:  37% (3519/9510)\rUpdating files:  38% (3614/9510)\rUpdating files:  39% (3709/9510)\rUpdating files:  40% (3804/9510)\rUpdating files:  41% (3900/9510)\rUpdating files:  42% (3995/9510)\rUpdating files:  43% (4090/9510)\rUpdating files:  44% (4185/9510)\rUpdating files:  45% (4280/9510)\rUpdating files:  46% (4375/9510)\rUpdating files:  47% (4470/9510)\rUpdating files:  48% (4565/9510)\rUpdating files:  48% (4570/9510)\rUpdating files:  49% (4660/9510)\rUpdating files:  50% (4755/9510)\rUpdating files:  51% (4851/9510)\rUpdating files:  52% (4946/9510)\rUpdating files:  53% (5041/9510)\rUpdating files:  54% (5136/9510)\rUpdating files:  55% (5231/9510)\rUpd… [truncated]

1:18

$git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode log --all --oneline --grep="CVE-2026-21518" | head -n 5

0.3s✓

1:20

$

git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode log --all --oneline --grep="cd11faec7b031b928bc5ec37f350d623ffb28713" | head -n 5

0.3s✓

1:22

$git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode cat-file -t cd11faec7b031b928bc5ec37f350d623ffb28713

✓

fatal: git cat-file: could not get object info

1:24

$git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode tag --list "1.109.*" | head -n 20

✓

1:25

$git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode rev-parse HEAD

✓

6e91d50e716e10d08f69dab525b801e9cfa022c7

1:30

2:58

$

git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode fetch --depth=500 origin cd11faec7b031b928bc5ec37f350d623ffb28713

88.2s✓

From https://github.com/microsoft/vscode
 * branch                    cd11faec7b031b928bc5ec37f350d623ffb28713 -> FETCH_HEAD

3:00

$git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode cat-file -t cd11faec7b031b928bc5ec37f350d623ffb28713

✓

commit

3:01

$git -C /root/.pruva/runs/cve-2026-21518_20260221-080904/vscode show cd11faec7b031b928bc5ec37f350d623ffb28713 --stat

✓

commit cd11faec7b031b928bc5ec37f350d623ffb28713
Author: Johannes Rieken <jrieken@microsoft.com>
Date:   Mon Feb 9 08:38:37 2026 +0100

    CVE-2026-21518 (MSRC#106249) (#32)
    
    * strings: add a punycode encoding function

3:04

3:04

Artifacts and Evidence for CVE-2026-21518

Scripts, logs, diffs, and output captured during the reproduction.

No artifacts available

08 · How to Fix

How to Fix CVE-2026-21518

Coming soon

Step-by-step mitigation and hardening guidance for CVE-2026-21518 — configuration checks, workarounds where no patch exists, and how to verify you're protected — is on the way.

FAQ: CVE-2026-21518

How does the CVE-2026-21518 attack work?

An attacker plants a malicious .vscode/settings.json in a repository or workspace defining an MCP server. When a victim opens that workspace without granting workspace trust, VS Code / GitHub Copilot could still start the defined MCP server, resulting in command execution.

How severe is CVE-2026-21518?

It is rated medium severity, requiring a victim to open an untrusted workspace containing an attacker-controlled .vscode/settings.json.

How can I reproduce CVE-2026-21518?

Download the verified script from this page and run it in an isolated environment against an affected VS Code / GitHub Copilot build. It opens a workspace containing a malicious .vscode/settings.json defining an MCP server without granting workspace trust, and shows the MCP server starting anyway; the fix adds workspace trust checks and punycode encoding for domain normalization before allowing MCP servers to start.

11 · References

References for CVE-2026-21518

Authoritative sources for CVE-2026-21518 — official vulnerability databases and the upstream advisory. Pruva's reproduction verifies the issue firsthand; these are the primary records to corroborate it.