Escaping well-configured VSCode extensions (for profit)
Summary: Trail of Bits found that a Webview's localResourceRoots restriction in VSCode could be bypassed by using %2f.. instead of /.. in a path, because VSCode decodes the %2f with decodeURIComponent but checks roots with resourceFsPath.startsWith(rootPath) without normalizing the path first. Microsoft assigned the bug CVE-2022-41042 and paid a $7,500 bounty, which the researchers noted worked out to about $2,500 per minute of bug finding.
What you should know: The bypass lets an attacker with JavaScript execution inside a Webview read files anywhere on the system, including those outside the configured roots, and the researchers found the working payload in about three minutes.
Read the original at Trail of Bits Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-41042
- Related
- Escaping misconfigured VSCode extensions Cyber Risks ·Vasco Franco Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026