Information Disclosure Vulnerability

MediumCVE-2022-41042 · Published Oct 11, 2022

An information disclosure vulnerability exists in VS Code 1.71 and earlier versions. If an attacker is able to run arbitrary scripts inside of a webview (either created by an extension or by core VS Code), the attacker could bypass the local resource roots check to read arbitrary files on the ### Patches The fix is available starting with **VS Code 1.71.1**. The [fix](https://github.com/microsoft/vscode/commit/fad9089781c40e7b35e43076ca2951085aa8264d) mitigates this attack by performing input validation on the URL pointing to the repository to be cloned. ### Workarounds Only use webviews from extensions that follow proper security measures to block script injection Do not disable VS Code's default security measures in the built-in markdown preview ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/fad9089781c40e7b35e43076ca2951085aa8264d * An issue can be found at https://github.com/microsoft/vscode/issues/163326 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41042