Remote Code Execution Vulnerability
HighCVE-2022-41034 · Published Oct 11, 2022
A remote code execution vulnerability exists in VS Code 1.71 and earlier versions for malicious notebooks. These notebooks could use command uris to execute arbitrary commands, including potentially dangerous commands ### Patches The fix is available starting with **VS Code 1.71.1**. The [fix](https://github.com/microsoft/vscode/commit/d2cff714d5410c570043e259fd72c75bbf387b7a) mitigates this attack by performing input validation on the URL pointing to the repository to be cloned. ### Workarounds Do not open notebooks from untrusted sources. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/d2cff714d5410c570043e259fd72c75bbf387b7a * An issue for this can be found at https://github.com/microsoft/vscode/issues/163321 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41034
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.71.1 | 1.71.1 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 102023 | Remote Code Execution Vulnerability | Medium | 1.74.3 |
| Oct 112022 | Information Disclosure Vulnerability | Medium | 1.71.1 |
| Sep 142022 | Elevation of Privilege Vulnerability | High | 1.71.1 |
| May 252022 | Remote Code Execution Vulnerability | High | 1.64.1 |
| May 252022 | Spoofing Vulnerability | High | 1.65.1 |
| May 252022 | Elevation of Privilege Vulnerability | High | 1.66.2 |