What happened
In VS Code versions before 1.145.3, the McpElicitationService falls back to a workbench notification when no chat session is available for an MCP elicitation/create request. A server-controlled message string is rendered as linked markdown, so a malicious MCP server can craft the message as a link pointing at a command: URI (e.g. workbench.action.terminal.sendSequence) or as an object mimicking the renderer's pre-parsed link-node structure; a single click executes a workbench command with the user's permissions. Microsoft assigned CVE-2026-120779 (CWE-94, CVSS 3.1 9.6 Critical; Microsoft's own rating 'Important') and fixed it in VS Code 1.145.3, released 2026-11-10, by rendering elicitation messages as literal text.
Why it matters
This is a direct agentic/MCP attack class: a remote MCP server that a developer connects to the IDE can cross the boundary from rendered text into local command execution in the developer's environment. Given VS Code's ubiquity (70%+ developer usage) and the rapid growth of remote MCP servers, an attacker who convinces a developer to connect a malicious server can achieve code execution under that user's privileges.
Attack vector
A malicious MCP server sends an elicitation/create request with a crafted message containing a command: URI (or an object mimicking pre-parsed link nodes); rendering the notification link and clicking it runs a workbench command under the user's privileges.
Affected systems
Microsoft Visual Studio Code < 1.145.3 (MCP elicitation / notification renderer)
Mitigation
Upgrade to VS Code 1.145.3+; treat MCP servers as untrusted and vet them before connecting, especially for privileged/remote servers.