Remote Code Execution Vulnerability
HighCVE-2023-24893 · Published Apr 11, 2023 · updated Apr 12, 2023
### Impact A vulnerability exists in VS Code 1.77.0 and earlier versions where escape sequences implemented by VS Code to support shell integration allow for a previously run command line to be replaced. As such, a user could be running a changed command unexpectedly when they use `re-run command`. ### Patches The fix is available starting with VS Code 1.77.1. The fix (6740c2ec22889c9e3c944917ff6377f43326a096) mitigates this by showing the user a notification with the command that is to be run and requires their approval to do so. ### References - The patch for this can be found at 6740c2ec22889c9e3c944917ff6377f43326a096 - An issue for this can be found at https://github.com/microsoft/vscode/issues/179701 - MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24893
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.77.1 | 1.77.1 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 122023 | Remote Code Execution Vulnerability | High | 1.82.1 |
| Sep 122023 | Remote Code Execution Vulnerability | High | 1.80.2 |
| Jun 132023 | Information Disclosure Vulnerability | High | 1.79.1 |
| May 92023 | Information Disclosure Vulnerability | High | 1.78.1 |
| Jan 102023 | Remote Code Execution Vulnerability | Medium | 1.74.3 |
| Oct 112022 | Information Disclosure Vulnerability | Medium | 1.71.1 |