Vulnerability (CVE)
Trail of Bits researchers found three vulnerabilities in VSCode extensions, including two in Microsoft's SARIF Viewer and Live Preview extensions that allowed arbitrary local file exfiltration, plus a VSCode mitigation bypass assigned CVE-2022-41042 with a...
Trail of Bits found that a Webview's localResourceRoots restriction in VSCode could be bypassed by using %2f.. instead of /.. in a path, because VSCode decodes the %2f with decodeURIComponent but checks roots with resourceFsPath.startsWith(rootPath)...
Trail of Bits researcher Vasco Franco published a June 17, 2025 post describing how JSON, XML, and YAML parsers in Go handle edge cases in ways that have repeatedly produced high-impact security issues in production systems. The post covers three attack...