Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in VS Code 1.66.1 and earlier versions on Windows if VS Code is installed in a custom location that is writable by other users on the system. The VS Code installer did not configure in any way the file system permissions for the VS Code installation directory, so the parent folder permissions would be inherited. ### Patches The fix is available starting with **VS Code 1.66.2**. The fix consists of 3 patches (https://github.com/microsoft/vscode/commit/7a9093a66c0d3c0bd9ca48c63572e3569ebedcd2, https://github.com/microsoft/vscode/commit/c2beae1c0ff11947b0c5f8d547376a9be3c9778c, https://github.com/microsoft/vscode/commit/c20b68a62d198e73df34de5f95671eb63c8b5ff2) and mitigates this attack by explicitly setting the permissions of the VS Code installation directory to limit write access to the current user and to system administrators. ### Workarounds If you have installed VS Code in a location which is writable by other users on your system, you can manually configure permissions on the VS Code installation directory to remove write access for other users on the same system. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/7a9093a66c0d3c0bd9ca48c63572e3569ebedcd2, https://github.com/microsoft/vscode/commit/c2beae1c0ff11947b0c5f8d547376a9be3c9778c, https://github.com/microsoft/vscode/commit/c20b68a62d198e73df34de5f95671eb63c8b5ff2 * An issue for this can be found at https://github.com/microsoft/vscode/issues/147316 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26921

Severity from

GitHub (reviewed advisory)

• github.com/microsoft/vscode/security/advisories/GHSA-wrm3-w8h4-q8mx
• github.com/microsoft/vscode