[CVE-2022-41042] Escaping misconfigured VSCode extensions

CVE

CVE-2022-41042

Published

2023-02-21 13:00

Collected

2026-07-03 04:01

---
id: 1692
title: "[CVE-2022-41042] Escaping misconfigured VSCode extensions"
cve: CVE-2022-41042
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2023/02/21/vscode-extension-escape-vulnerability/"
published_at: "2023-02-21T13:00:50Z"
tags: ["vulnerability-research", "xss", "path-traversal", "vulnerability-disclosure", "trail-of-bits", "vscode", "cve-2022-41042", "extension-security", "html-injection", "csp-bypass", "file-exfiltration", "local-file-theft"]
phying_url: "https://phying.com/item/1692"
lang: en
---

# [CVE-2022-41042] Escaping misconfigured VSCode extensions

## Summary

Part one of the series: three vulnerabilities in Microsoft's SARIF Viewer and Live Preview VSCode extensions enabling local file theft, plus the $7,500-bounty CVE-2022-41042 mitigation bypass.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **CVE:** CVE-2022-41042
- **Published:** 2023-02-21T13:00:50Z
- **Original:** https://blog.trailofbits.com/2023/02/21/vscode-extension-escape-vulnerability/
- **Phying News:** https://phying.com/item/1692