Visual Studio Code Python Extension Remote Code Execution Vulnerability

<p>A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit this vulnerability, an attacker would need to convince a target to open a specially crafted file in Visual Studio Code with the Python extension installed.</p> <p>The update addresses the vulnerability by modifying the way Visual Studio Code Python extension renders notebook content.</p>

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A

Microsoft Visual Studio Code 安全漏洞

Microsoft Visual Studio Code是美国微软（Microsoft）公司的一款开源的代码编辑器。 Microsoft Visual Studio Code 存在安全漏洞，该漏洞源于当 Python 扩展程序加载 Jupyter 笔记本文件时，Visual Studio Code 中存在远程代码执行漏洞。攻击者可利用该漏洞可以在当前用户的上下文中运行任意代码。以下产品及版本受到影响： Visual Studio Code版本。

N/A

N/A