From 8a2193935ed4ed0cb63a40940c242894278cb26b Mon Sep 17 00:00:00 2001 From: Sachin Hulyalkar Date: Mon, 27 Jul 2026 19:40:53 +0000 Subject: [PATCH] fix: register backport reconciliation for upstream advisory fixes Record three upstream microsoft/vscode 1.128.1 hardening fixes against Code-OSS 1.101.2 in patches/backported-patches.json: - Copilot completions config override-URL hardening: the copilot extension and completions-core config are not shipped in this branch, and no advanced.debug.overrideCapiUrl/overrideProxyUrl settings exist in source; recorded as not-present (patch_path N/A). - Notebook mermaid render hardening: no mermaid extension or renderMermaidBlocksInElement re-parse pattern is present; the markdown notebook renderer already sanitizes untrusted HTML via DOMPurify; recorded as not-present (patch_path N/A). - Extension host iframe parentOrigin validation: already mitigated by the existing patches/web-server/webview.diff, which forces parentOrigin to window.origin in the non-validated hostname path and never uses the attacker-supplied search param there; recorded as covered by that patch. Remove when Code-OSS is updated to >= 1.128.1. --- patches/backported-patches.json | 42 +++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/patches/backported-patches.json b/patches/backported-patches.json index 78e72ed..18b4318 100644 --- a/patches/backported-patches.json +++ b/patches/backported-patches.json @@ -94,5 +94,47 @@ "patch_path": "N/A", "link": "https://github.com/microsoft/vscode/security/advisories/GHSA-rg3f-8xq5-hwh6", "note": "Copilot extension not present in Code-OSS 1.101.2" + }, + { + "finding_id": "CVE-2026-47282", + "affected_versions": "< 1.128.1", + "patch_path": "N/A", + "link": "https://github.com/microsoft/vscode/commit/f05bcd1aa29cff28a62fe137b4a16fec9393f31b", + "note": "Copilot completions config not present in Code Editor 1.101.2 - no extensions/copilot, no completions-core, and no advanced.debug.overrideCapiUrl/overrideProxyUrl settings in shipped source" + }, + { + "finding_id": "GHSA-wr9x-42j2-jvh3", + "affected_versions": "< 1.128.1", + "patch_path": "N/A", + "link": "https://github.com/microsoft/vscode/commit/f05bcd1aa29cff28a62fe137b4a16fec9393f31b", + "note": "Copilot completions config not present in Code Editor 1.101.2 - no extensions/copilot, no completions-core, and no advanced.debug.overrideCapiUrl/overrideProxyUrl settings in shipped source" + }, + { + "finding_id": "CVE-2026-57101", + "affected_versions": "< 1.128.1", + "patch_path": "N/A", + "link": "https://github.com/microsoft/vscode/commit/bc2d56c6f8da22a4bd31f741fcb034208770f158", + "note": "Vulnerable mermaid notebook renderer not present in Code Editor 1.101.2 - no mermaid extension, no renderMermaidBlocksInElement, and no sanitized-HTML re-parse via innerHTML; markdown notebook renderer uses DOMPurify.sanitize directly" + }, + { + "finding_id": "GHSA-9mw4-h26x-gfxw", + "affected_versions": "< 1.128.1", + "patch_path": "N/A", + "link": "https://github.com/microsoft/vscode/commit/bc2d56c6f8da22a4bd31f741fcb034208770f158", + "note": "Vulnerable mermaid notebook renderer not present in Code Editor 1.101.2 - no mermaid extension, no renderMermaidBlocksInElement, and no sanitized-HTML re-parse via innerHTML; markdown notebook renderer uses DOMPurify.sanitize directly" + }, + { + "finding_id": "CVE-2026-57102", + "affected_versions": "< 1.128.1", + "patch_path": "patches/web-server/webview.diff", + "link": "https://github.com/microsoft/vscode/commit/236fa7d8ea86f0f4261df38e1a17b3c7e7002bd0", + "note": "webWorkerExtensionHostIframe.html hardening already shipped: in the non-validated hostname path parentOrigin is forced to window.origin and the attacker-supplied parentOrigin search param is never used, equivalent to upstream's explicit parentOrigin rejection" + }, + { + "finding_id": "GHSA-v282-cxqj-xgj4", + "affected_versions": "< 1.128.1", + "patch_path": "patches/web-server/webview.diff", + "link": "https://github.com/microsoft/vscode/commit/236fa7d8ea86f0f4261df38e1a17b3c7e7002bd0", + "note": "webWorkerExtensionHostIframe.html hardening already shipped: in the non-validated hostname path parentOrigin is forced to window.origin and the attacker-supplied parentOrigin search param is never used, equivalent to upstream's explicit parentOrigin rejection" } ]