Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability? An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Exploitation would require a user to open or view a maliciously crafted notebook so that the affected content is rendered.
<a href="https://www.linkedin.com/in/tarek-nakkouch/">Tarek Nakkouch</a>