module
VSCode ipynb Remote Development RCE
| Disclosed |
|---|
| Nov 22, 2022 |
Disclosed
Nov 22, 2022
Description
VSCode when opening an Jupyter notebook (.ipynb) file bypasses the trust model.
On versions v1.4.0 - v1.71.1, its possible for the Jupyter notebook to embed
HTML and javascript, which can then open new terminal windows within VSCode.
Each of these new windows can then execute arbitrary code at startup.
During testing, the first open of the Jupyter notebook resulted in pop-ups
displaying errors of unable to find the payload exe file. The second attempt
at opening the Jupyter notebook would result in successful exeuction.
Successfully tested against VSCode 1.70.2 on Windows 10.
On versions v1.4.0 - v1.71.1, its possible for the Jupyter notebook to embed
HTML and javascript, which can then open new terminal windows within VSCode.
Each of these new windows can then execute arbitrary code at startup.
During testing, the first open of the Jupyter notebook resulted in pop-ups
displaying errors of unable to find the payload exe file. The second attempt
at opening the Jupyter notebook would result in successful exeuction.
Successfully tested against VSCode 1.70.2 on Windows 10.
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.