Visual Studio Code Remote Code Execution Vulnerability

How could an attacker exploit this vulnerability?
An unauthenticated attacker could convince a user with an active, previously authenticated Visual Studio Code web-server session to open a specially crafted link. If a vulnerable older server version remains available, successful exploitation could cause that version to run and allow the attacker to execute code with the server account's permissions.

According to the CVSS metric, the attack complexity is high (AC:H). What does this mean for this vulnerability?
An attacker would need specific conditions to be in place (i.e. particular protocol settings, or configurations, etc.) before an attack could succeed, which reduces the likelihood of widespread or opportunistic exploitation.

Security updates
1.145.3 — https://code.visualstudio.com/updates/v1_145