Remote Code Execution Vulnerability
HighCVE-2023-39956 · Published Sep 12, 2023
A remote code execution vulnerability exists in VS Code 1.80.1 and earlier versions where opening a maliciously crafted workspace from the command line `code <attacker-controlled-workspace>` can result in executing commands locally. Specifically this issue can only be exploited if the following conditions are met: * VS Code is launched with an attacker-controlled working directory * The attacker has the ability to write files to that working directory ### Patches The fix is available starting with VS Code 1.80.2. The fix (https://github.com/microsoft/vscode/commit/2ccd690cbff1569e4a83d7c43d45101f817401dc) mitigates the attack by updating to a newer version of Electron that contains the security fix. ### Workarounds There are no application side workarounds other than updating VS Code to the fixed version. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/2ccd690cbff1569e4a83d7c43d45101f817401dc * An issue for this can be found at https://github.com/microsoft/vscode/issues/192902 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-39956 * Electron's advisory can be found at https://gith...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.80.2 | 1.80.2 |
Details and references
A remote code execution vulnerability exists in VS Code 1.80.1 and earlier versions where opening a maliciously crafted workspace from the command line `code <attacker-controlled-workspace>` can result in executing commands locally. Specifically this issue can only be exploited if the following conditions are met: * VS Code is launched with an attacker-controlled working directory * The attacker has the ability to write files to that working directory ### Patches The fix is available starting with VS Code 1.80.2. The fix (https://github.com/microsoft/vscode/commit/2ccd690cbff1569e4a83d7c43d45101f817401dc) mitigates the attack by updating to a newer version of Electron that contains the security fix. ### Workarounds There are no application side workarounds other than updating VS Code to the fixed version. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/2ccd690cbff1569e4a83d7c43d45101f817401dc * An issue for this can be found at https://github.com/microsoft/vscode/issues/192902 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-39956 * Electron's advisory can be found at https://github.com/advisories/GHSA-7x97-j373-85x5
- Severity from
- GitHub (reviewed advisory)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 122024 | Elevation of Privilege Vulnerability | High8.8 | 1.87.2 |
| Sep 122023 | Remote Code Execution Vulnerability | High | 1.82.1 |
| Jun 132023 | Information Disclosure Vulnerability | High | 1.79.1 |
| May 92023 | Information Disclosure Vulnerability | High | 1.78.1 |
| Apr 112023 | Remote Code Execution Vulnerability | High | 1.77.1 |
| Jan 102023 | Remote Code Execution Vulnerability | Medium | 1.74.3 |