Visual Studio Code for Linux Remote Code Execution Vulnerability

A remote code execution vulnerability exists in VS Code 1.94.0 and earlier versions in the elevated save flow.

Patches

The fix is available starting with VS Code 1.94.1. The fix (https://github.com/microsoft/vscode/commit/28000dfc8dd75bab443cf771cb1a7142219b4ae4) mitigates this attack by only allowing elevated save in trusted workspaces and hardening how arguments are passed around.

Workarounds

A way to avoid the vulnerability without updating is to not use the elevated save flow.

References

• The patch for this can be found at https://github.com/microsoft/vscode/commit/28000dfc8dd75bab443cf771cb1a7142219b4ae4
• An issue for this can be found at https://github.com/microsoft/vscode/issues/230824
• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43601