Remote Code Execution Vulnerability
HighCVE-2022-30129 · Published May 25, 2022 · updated May 30, 2022
A remote code execution vulnerability exists in VS Code 1.67.0 and earlier versions where opening a maliciously crafted URL intended for the "clone git repository from a URL" feature can result in executing commands locally. This scenario would require the attacker to get the VS Code user to open the malicious URL and then confirm opening it in the prompt shown by VS Code. ### Patches The fix is available starting with **VS Code 1.67.1**. The fix (https://github.com/microsoft/vscode/commit/c5da5332d54f610b1b3e6dd9ea9b699971b57407) mitigates this attack by performing input validation on the URL pointing to the repository to be cloned. ### Workarounds Do not open `vscode://` URLs that originate from an untrusted source. Do not confirm opening untrusted URLs in VS Code. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/c5da5332d54f610b1b3e6dd9ea9b699971b57407 * An issue for this can be found at https://github.com/microsoft/vscode/issues/149177 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30129
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.67.1 | 1.67.1 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Oct 112022 | Information Disclosure Vulnerability | Medium | 1.71.1 |
| Oct 112022 | Remote Code Execution Vulnerability | High | 1.71.1 |
| Sep 142022 | Elevation of Privilege Vulnerability | High | 1.71.1 |
| May 252022 | Remote Code Execution Vulnerability | High | 1.64.1 |
| May 252022 | Spoofing Vulnerability | High | 1.65.1 |
| May 252022 | Elevation of Privilege Vulnerability | High | 1.66.2 |