Remote Code Execution Vulnerability

Impact

A vulnerability exists in VS Code 1.77.0 and earlier versions where escape sequences implemented by VS Code to support shell integration allow for a previously run command line to be replaced. As such, a user could be running a changed command unexpectedly when they use re-run command.

Patches

The fix is available starting with VS Code 1.77.1. The fix (6740c2ec22889c9e3c944917ff6377f43326a096) mitigates this by showing the user a notification with the command that is to be run and requires their approval to do so.

References

• The patch for this can be found at 6740c2ec22889c9e3c944917ff6377f43326a096
• An issue for this can be found at https://github.com/microsoft/vscode/issues/179701
• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24893