Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
How could an attacker exploit this vulnerability? An attacker could craft a malicious link or web page and use social engineering to convince a user to open it in Visual Studio Code. Successful exploitation could result in code execution in the user's connected development environment. User interaction is required to open the attacker-supplied link, and no authentication is needed.
<a href="https://www.linkedin.com/in/william-conlon-0489b910b/">William Conlon</a> with <a href="https://www.microsoft.com/">Microsoft</a>