Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
How could an attacker exploit this vulnerability? An attacker could craft a malicious link or web page and use social engineering to convince a user to open it in Visual Studio Code. Successful exploitation could result in code execution in the user's connected development environment. User interaction is required to open the attacker-supplied link, and no authentication is needed.
<a href="https://x.com/zemnmez">Thomas Neil James Shadwell (zemnmez)</a> with <a href="https://openai.com/">OpenAI</a>