Visual Studio Code Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code. Attacker-specified code would execute when the target opened the integrated terminal. The update address the vulnerability by modifying the way Visual Studio Code handles environment variables.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

N/A

Microsoft Visual Studio Code 安全漏洞

Microsoft Visual Studio Code是美国微软（Microsoft）公司的一款开源的代码编辑器。 Microsoft Visual Studio Code中存在远程代码执行漏洞。攻击者可通过诱使用户复制资源库并在Visual Studio Code中将其打开利用该漏洞在当前用户的上下文中运行任意代码。以下产品及版本受到影响： Visual Studio Code版本。

N/A

N/A