Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
How could an attacker exploit this vulnerability? An attacker could host a specially crafted web page and use social engineering to convince a user to have the application retrieve it. The malicious page could then cause the application to launch operating-system protocol handlers without prompting the user, which could result in code execution on the user's system. User interaction is required.
<a href="https://www.linkedin.com/in/sdalili/">Soroush Dalili</a> with <a href="https://www.bentley.com/">Bentley Systems</a>