Critical vulnerabilities in four widely used VS Code extensions could enable file theft and remote code execution across 125M installs.

Three of the four vulnerabilities remained unpatched months after OX Security reported them to the maintainers.

Updates to GitHub Copilot in VS Code provide the same C++ symbol context and CMake build configuration awareness as Microsoft’s C/C++ DevTools and CMake Tools extensions.

A Hacker News commenter identifying as a VS Code team member said Workspace Trust is the intended security protection against repo-based attacks. The commenter acknowledged user experience issues and ...