Escaping misconfigured VSCode extensions
Summary: Trail of Bits researchers found three vulnerabilities in VSCode extensions, including two in Microsoft's SARIF Viewer and Live Preview extensions that allowed arbitrary local file exfiltration, plus a VSCode mitigation bypass assigned CVE-2022-41042 with a $7,500 bounty. The SARIF Viewer bug stemmed from rendering result descriptions with ReactMarkdown and escapeHtml set to false, combined with a permissive localResourceRoots that allowed reading files anywhere on disk, and the Live Preview bug came from an unsanitized innerHTML assignment in a postMessage handler.
Bottom line: An attacker who controls a SARIF file or a malicious HTML page could read and exfiltrate a user's private SSH key at ~/.ssh/id_rsa, and the Live Preview extension alone has more than 1 million installs.
Read the original at Trail of Bits Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-41042
- Related
- Escaping well-configured VSCode extensions (for profit) Cyber Risks ·Vasco Franco Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026