Visual Studio Code Remote Code Execution Vulnerability

How could an attacker exploit this vulnerability?
An attacker could craft a malicious link or web page and use social engineering to convince a user to open it in Visual Studio Code. Successful exploitation could result in code execution in the user's connected development environment. User interaction is required to open the attacker-supplied link, and no authentication is needed.

According to the CVSS metric, the attack complexity is high (AC:H). What does this mean for this vulnerability?
An attacker would need specific conditions to be in place (i.e. particular protocol settings, or configurations, etc.) before an attack could succeed, which reduces the likelihood of widespread or opportunistic exploitation.

Security updates
1.145.3 — https://code.visualstudio.com/updates/v1_145