← back | CVE Intelligence

CVE-2022-41042

Curated 2 security research writeups, vulnerability advisories and exploitation analyses for CVE-2022-41042.

Coverage Span: 2023-02-21 → 2023-02-23
Reports: 2 related reports

Associated Reports & Timeline

Escaping well-configured VSCode extensions (for profit)

Part two of the series: bypassing a Webview's localResourceRoots via URL parsing differences in VSCode's Electron browser to read arbitrary files; fixed as CVE-2022-41042 with a $7,500 bounty.

Escaping misconfigured VSCode extensions

Part one of the series: three vulnerabilities in Microsoft's SARIF Viewer and Live Preview VSCode extensions enabling local file theft, plus the $7,500-bounty CVE-2022-41042 mitigation bypass.