Remote Code Execution Vulnerability

A remote code execution vulnerability exists in VS Code 1.71 and earlier versions for malicious notebooks. These notebooks could use command uris to execute arbitrary commands, including potentially dangerous commands

Patches

The fix is available starting with VS Code 1.71.1. The [fix](https://github.com/microsoft/vscode/commit/d2cff714d5410c570043e259fd72c75bbf387b7a) mitigates this attack by performing input validation on the URL pointing to the repository to be cloned.

Workarounds

Do not open notebooks from untrusted sources.

References

• The patch for this can be found at https://github.com/microsoft/vscode/commit/d2cff714d5410c570043e259fd72c75bbf387b7a
• An issue for this can be found at https://github.com/microsoft/vscode/issues/163321
• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41034