One Click in a Malicious VS Code Project Can Give Attackers Persistent Access to Your PC
Brief
A serious Visual Studio Code security issue could let attackers gain persistent access to a developer’s workstation with a single click inside a malicious project folder.
The attack abuses clickable links in VS Code’s source editor to bypass the protection expected from Workspace Trust. Workspace Trust is designed to protect users when they open code from an unknown source. When a folder is untrusted, VS Code enters Restricted Mode.
It should prevent risky actions, such as running tasks, debuggers, or terminal commands. The main idea is simple: merely opening an unknown repository should not execute attacker-controlled code.
However, Remedio researchers found a path that may allow a malicious project to trigger internal VS Code commands through a crafted command: link.
VS Code automatically detects URLs in files such as READMEs, comments, and Markdown documents.