Skip to content
MicrosoftGHSA-p996-wrgh-crrj

Remote Code Execution Vulnerability

MediumCVE-2023-21779 · Published Jan 10, 2023 · updated Apr 5, 2023

A remote code execution vulnerability exists in VS Code 1.74.2 and earlier versions where opening a maliciously crafted notebook allows script execution inside of the notebook's iframe. This works in untrusted workspaces and only requires that the user open the notebook. The executed script is run inside of an isolated iframe, however it is possible an attacker could combine this with additional exploits to break out of the iframe ### Patches The fix is available starting with **VS Code 1.74.3**. The fix (https://github.com/microsoft/vscode/commit/5b8361bc717608db4359c2572d5b447f94bc3fb8) mitigates this attack by more safely constructing html ### Workarounds Do not open notebooks from untrusted sources ### References https://github.com/microsoft/vscode/commit/5b8361bc717608db4359c2572d5b447f94bc3fb8 * An issue for this can be found at https://github.com/microsoft/vscode/issues/170992 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21779

GitHub advisory

Affected versions

PackageAffectedFixed in
VS Code
Product
< 1.74.31.74.3
Details and references

More Microsoft advisories

All Microsoft
Advisory
Information Disclosure Vulnerability
HighJun 13, 2023
Information Disclosure Vulnerability
HighMay 9, 2023
Remote Code Execution Vulnerability
HighApr 11, 2023
Information Disclosure Vulnerability
MediumOct 11, 2022
Remote Code Execution Vulnerability
HighOct 11, 2022
Elevation of Privilege Vulnerability
HighSep 14, 2022

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.