Spoofing Vulnerability
HighCVE-2022-24526 · Published May 25, 2022 · updated May 30, 2022
A spoofing vulnerability exists in VS Code 1.65.0 and earlier versions where the `<iframe>` used for rendering webviews could be embedded in a parent frame with an unexpected origin, and the `<iframe>` would communicate with the parent frame despite its unexpected origin. ### Patches The fix is available starting with **VS Code 1.65.1**. The fix (https://github.com/microsoft/vscode/commit/c569182d081410046ee6e6938e960d1e83063612) mitigates this attack by restricting the `<iframe>` origin to a value that is computed taking the parent frame origin into account, thus isolating different parent frame origins. ### Workarounds There are no known workarounds. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/c569182d081410046ee6e6938e960d1e83063612 * An issue for this can be found at https://github.com/microsoft/vscode/issues/144703 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24526
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.65.1 | 1.65.1 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Oct 112022 | Information Disclosure Vulnerability | Medium | 1.71.1 |
| Oct 112022 | Remote Code Execution Vulnerability | High | 1.71.1 |
| Sep 142022 | Elevation of Privilege Vulnerability | High | 1.71.1 |
| May 252022 | Remote Code Execution Vulnerability | High | 1.64.1 |
| May 252022 | Elevation of Privilege Vulnerability | High | 1.66.2 |
| May 252022 | Remote Code Execution Vulnerability | High | 1.67.1 |