CVE-2022-41034

published 2022-10-11

CVE-2022-41034: Visual Studio Code Remote Code Execution Vulnerability

Priority P2 63 high 7.8 CVSS 3.1

AV L AC L PR N UI R S U C H I H A H

EXPLOIT

Visual Studio Code Remote Code Execution Vulnerability

Affected

3 ranges

Vendor	Product	Version range	Fixed in
microsoft	visual_studio_code	< 1.72.1	1.72.1
microsoft	visual_studio_code	>= 1.0.0 < 1.72.1	1.72.1
msrc	visual_studio_code	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename .ipynb↗

• → Monitor VSCode processes spawning new terminal windows (e.g., child processes of code.exe) when opening .ipynb files, as the exploit embeds HTML/JavaScript in Jupyter notebooks to open terminal windows that execute arbitrary code at startup. ↗
• → Alert on VSCode versions v1.4.0 through v1.71.1 opening .ipynb files, as these versions are confirmed vulnerable to the trust model bypass. ↗
• → Social engineering vector: watch for users downloading and opening specially crafted .ipynb files from external websites, which triggers the local attack chain. ↗

• · The exploit may require two open attempts to succeed; the first open of the malicious notebook may only produce error pop-ups (payload exe not found), while the second attempt results in successful execution. Detection logic should account for repeated .ipynb file open events. ↗
• · The CVE title says 'Remote Code Execution' but the attack vector is local (AV:L) — the attacker is remote but execution is local. Do not confuse this with network-based RCE when tuning detection rules. ↗

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vendor_msrc 7.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.