Elevation of Privilege Vulnerability
MediumCVE-2025-24042 · Published Feb 11, 2025
## VS Code - Local escalation of priviledge vulnerability A vulnerability exists in VS Code 1.97.0 and earlier versions where an attacker with write permissions on certain common directories can place a binary that would be executed automatically by the JavaScript debugger. This requires an attacker to be able to create and modify files on the user's machine. ### Patches The fix is available starting with **VS Code 1.97.1**. The fix mitigates this by not resolving node_modules binaries outside of the workspace foler. ### Workarounds Specify absolute paths for the `runtimeExecutable` whenever you launch a program with the JavaScript debugger. ### References * The patch for this can be found at https://github.com/microsoft/vscode-js-debug/commit/51f431eaa3e8fe0e186e4e7e02664f5ae9aa1793 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24042
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.97.1 | 1.97.1 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Feb 10 | Workspace trust for MCP servers | Low | 1.109.1 |
| May 132025 | Security Feature Bypass Vulnerability | High | 1.100.1 |
| Apr 82025 | Remote Code Execution Vulnerability | High | 1.99.1 |
| Feb 112025 | Elevation of Privilege Vulnerability | High | 1.97.1 |
| Oct 82024 | Visual Studio Code for Linux Remote Code Execution Vulnerability | High | 1.94.1 |
| Mar 122024 | Elevation of Privilege Vulnerability | High8.8 | 1.87.2 |