
VS Code 1.145.3 Fixes Three MCP Flaws That Let Servers Run Commands
VS Code 1.145.3 fixes three MCP flaws that let a malicious server or vscode:mcp/install link run commands as the developer. Patch now, ask fork vendors about their status, and set an MCP allowlist.
November 12, 2026 · 9 min read