Skip to content
OpenAdvisories
High MSRC-CVE-2023-21779 1 CVE

Visual Studio Code Remote Code Execution Vulnerability

Published Jan 10, 2023 · Updated May 9, 2023 · Revision 3

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.
For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
The user would have be enticed to open a malicious file in vscode. Users should never open anything that they do not know or trust to be safe.

Security updates
1.74.3 — https://code.visualstudio.com/updates/v1_74

Vulnerabilities 1

Revision history

  1. #3

    Updated one or more CVSS scores for the affected products. This is an informational change only.

  2. #2

    Corrected CVE title. This is an informational change only.

  3. #1

    Information published.

References