Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability? This means that a successful attack is not limited to Visual Studio Code itself, but can also affect the user’s local system, including files and settings. As a result, the impact extends beyond the application to a different security boundary, increasing the overall severity of the vulnerability. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? The user would have be enticed to open a malicious .code-workspace file in vscode. Users should never open anything that they do not know or trust to be safe.
<a href="https://bsky.app/profile/evilpacket.net">Adam Baldwin</a> with https://evilpacket.net/