Remote Code Execution Vulnerability
HighCVE-2025-20570 · Published Apr 8, 2025
### Description A remote code execution vulnerability exists in VS Code 1.99.0 and earlier versions where another user within the same group could edit the $ZDOTDIR and have extra code executed in the integrated zshell. ### Patches The fix is available starting with **VS Code 1.99.1**. The fix (https://github.com/microsoft/vscode/commit/2f2e2c47d406976b6976ec6114eab8ac44d63513) mitigates this attack by setting the sticky bit and remove group and other permissions to restrict the folder to the user that created it. ### Workarounds Disable shell integration in VS Code by setting `"terminal.integrated.shellIntegration.enabled": false` or do not open a zshell within VS Code. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/2f2e2c47d406976b6976ec6114eab8ac44d63513 * A github issue for this can be found at https://github.com/microsoft/vscode/issues/246012 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-20570
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.99.1 | 1.99.1 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Feb 10 | Terminal auto replies restriction | High8.0 | 1.109.1 |
| Feb 10 | Workspace trust for MCP servers | Low | 1.109.1 |
| May 132025 | Security Feature Bypass Vulnerability | High | 1.100.1 |
| Feb 112025 | Elevation of Privilege Vulnerability | High | 1.97.1 |
| Feb 112025 | Elevation of Privilege Vulnerability | Medium | 1.97.1 |
| Oct 82024 | Visual Studio Code for Linux Remote Code Execution Vulnerability | High | 1.94.1 |