Remote Code Execution Vulnerability
MediumCVE-2023-21779 · Published Jan 10, 2023 · updated Apr 5, 2023
A remote code execution vulnerability exists in VS Code 1.74.2 and earlier versions where opening a maliciously crafted notebook allows script execution inside of the notebook's iframe. This works in untrusted workspaces and only requires that the user open the notebook. The executed script is run inside of an isolated iframe, however it is possible an attacker could combine this with additional exploits to break out of the iframe ### Patches The fix is available starting with **VS Code 1.74.3**. The fix (https://github.com/microsoft/vscode/commit/5b8361bc717608db4359c2572d5b447f94bc3fb8) mitigates this attack by more safely constructing html ### Workarounds Do not open notebooks from untrusted sources ### References https://github.com/microsoft/vscode/commit/5b8361bc717608db4359c2572d5b447f94bc3fb8 * An issue for this can be found at https://github.com/microsoft/vscode/issues/170992 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21779
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| VS Code Product | < 1.74.3 | 1.74.3 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 132023 | Information Disclosure Vulnerability | High | 1.79.1 |
| May 92023 | Information Disclosure Vulnerability | High | 1.78.1 |
| Apr 112023 | Remote Code Execution Vulnerability | High | 1.77.1 |
| Oct 112022 | Information Disclosure Vulnerability | Medium | 1.71.1 |
| Oct 112022 | Remote Code Execution Vulnerability | High | 1.71.1 |
| Sep 142022 | Elevation of Privilege Vulnerability | High | 1.71.1 |