Information Disclosure Vulnerability

An information disclosure vulnerability exists in VS Code 1.71 and earlier versions. If an attacker is able to run arbitrary scripts inside of a webview (either created by an extension or by core VS Code), the attacker could bypass the local resource roots check to read arbitrary files on the

Patches

The fix is available starting with VS Code 1.71.1. The [fix](https://github.com/microsoft/vscode/commit/fad9089781c40e7b35e43076ca2951085aa8264d) mitigates this attack by performing input validation on the URL pointing to the repository to be cloned.

Workarounds

Only use webviews from extensions that follow proper security measures to block script injection

Do not disable VS Code's default security measures in the built-in markdown preview

References

• The patch for this can be found at https://github.com/microsoft/vscode/commit/fad9089781c40e7b35e43076ca2951085aa8264d
• An issue can be found at https://github.com/microsoft/vscode/issues/163326
• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41042