Skip to content
MicrosoftGHSA-jfjw-mv65-hg44

Remote Code Execution Vulnerability

HighCVE-2022-30129 · Published May 25, 2022 · updated May 30, 2022

A remote code execution vulnerability exists in VS Code 1.67.0 and earlier versions where opening a maliciously crafted URL intended for the "clone git repository from a URL" feature can result in executing commands locally. This scenario would require the attacker to get the VS Code user to open the malicious URL and then confirm opening it in the prompt shown by VS Code. ### Patches The fix is available starting with **VS Code 1.67.1**. The fix (https://github.com/microsoft/vscode/commit/c5da5332d54f610b1b3e6dd9ea9b699971b57407) mitigates this attack by performing input validation on the URL pointing to the repository to be cloned. ### Workarounds Do not open `vscode://` URLs that originate from an untrusted source. Do not confirm opening untrusted URLs in VS Code. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/c5da5332d54f610b1b3e6dd9ea9b699971b57407 * An issue for this can be found at https://github.com/microsoft/vscode/issues/149177 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30129

GitHub advisory

Affected versions

PackageAffectedFixed in
vscode
Product
< 1.67.11.67.1
Details and references

More Microsoft advisories

All Microsoft
Advisory
Information Disclosure Vulnerability
MediumOct 11, 2022
Remote Code Execution Vulnerability
HighOct 11, 2022
Elevation of Privilege Vulnerability
HighSep 14, 2022
Remote Code Execution Vulnerability
HighMay 25, 2022
Spoofing Vulnerability
HighMay 25, 2022
Elevation of Privilege Vulnerability
HighMay 25, 2022

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.