Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
How could an attacker exploit this vulnerability? An attacker could convince a user to import a specially crafted Visual Studio Code profile or open specially crafted content or links. Successful exploitation could bypass path-containment checks, allowing access outside intended locations and potentially resulting in code execution in the context of the user.
<a href="https://rayhan.ch/">Rayhan Destian</a>, <a href="https://x.com/vulda17">vulda1</a> with Viettel Cyber Security