[CVE-2022-41042] Escaping well-configured VSCode extensions (for profit)

CVE

CVE-2022-41042

Published

2023-02-23 13:00

Collected

2026-07-03 04:00

---
id: 1689
title: "[CVE-2022-41042] Escaping well-configured VSCode extensions (for profit)"
cve: CVE-2022-41042
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2023/02/23/escaping-well-configured-vscode-extensions-for-profit/"
published_at: "2023-02-23T13:00:42Z"
tags: ["arbitrary-file-read", "vulnerability-research", "path-traversal", "vulnerability-disclosure", "webview", "trail-of-bits", "electron", "vscode", "cve-2022-41042", "url-parsing"]
phying_url: "https://phying.com/item/1689"
lang: en
---

# [CVE-2022-41042] Escaping well-configured VSCode extensions (for profit)

## Summary

Part two of the series: bypassing a Webview's localResourceRoots via URL parsing differences in VSCode's Electron browser to read arbitrary files; fixed as CVE-2022-41042 with a $7,500 bounty.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **CVE:** CVE-2022-41042
- **Published:** 2023-02-23T13:00:42Z
- **Original:** https://blog.trailofbits.com/2023/02/23/escaping-well-configured-vscode-extensions-for-profit/
- **Phying News:** https://phying.com/item/1689