Skip to content
[CVE-2022-41042] Escaping misconfigured VSCode extensions
blog.trailofbits.com | vulnerability | CVE-2022-41042 | #vulnerability-research | #xss | #path-traversal | #vulnerability-disclosure | #trail-of-bits | #vscode | #cve-2022-41042 | #extension-security | #html-injection | #csp-bypass | #file-exfiltration | #local-file-theft
Summary
Part one of the series: three vulnerabilities in Microsoft's SARIF Viewer and Live Preview VSCode extensions enabling local file theft, plus the $7,500-bounty CVE-2022-41042 mitigation bypass.
- Published
- Collected