Critical VS Code Vulnerability Lets Attackers Access PCs

Key Takeaways

• A critical vulnerability in Visual Studio Code (VS Code) allows attackers to gain persistent access to developer workstations.
• The flaw bypasses VS Code’s “Workspace Trust” security feature by abusing clickable command links within malicious project folders.
• A single click on a crafted link can install a malicious extension, even in Restricted Mode, granting the attacker arbitrary code execution.
• This vulnerability poses a significant supply chain risk due to developers’ elevated access to sensitive systems and data.
• A mitigation exists by disabling clickable links in the editor settings. Users should also avoid clicking suspicious links and review installed extensions.

Critical VS Code Flaw Bypasses Workspace Trust, Enables Persistent Access

A severe security vulnerability in Microsoft’s Visual Studio Code (VS Code) integrated development environment (IDE) could allow attackers to establish persistent access to a developer’s machine. The flaw leverages a cunning bypass of VS Code’s “Workspace Trust” feature, designed to safeguard users when interacting with untrusted code.

Exploiting this vulnerability requires only a single click within a specially crafted malicious project folder. This action can lead to the installation of an attacker-controlled extension, granting persistent access and potentially compromising critical development infrastructure.

Workspace Trust Circumvention

Workspace Trust is a core security mechanism in VS Code, intended to prevent the execution of malicious code when a user opens an unknown or untrusted project. When a folder is not explicitly trusted, VS Code enters “Restricted Mode,” which should disable risky operations such as running tasks, debuggers, or terminal commands. The fundamental principle is that simply opening a repository should not automatically execute code controlled by an attacker.

However, researchers at Remedio discovered a method to circumvent this protection. Their findings indicate that a malicious project can trigger internal VS Code commands via a specially formatted command: link.

VS Code automatically identifies URLs within various file types, including READMEs, comments, and Markdown documents. Users typically interact with these links by Ctrl+clicking them, expecting to navigate to websites or documentation. Crucially, VS Code also supports a distinct command: URL scheme. Instead of launching a web browser, these links invoke internal editor commands and can pass arguments to them. VS Code features hundreds of built-in commands, with many more added by installed extensions.

One-Click Malicious Extension Installation

One particular command, workbench.extensions.installExtension, is central to this attack. According to VS Code’s command reference, this command can install an extension using either its identifier or a VSIX extension package URI.

An attacker could embed a command link disguised within benign-looking text, such as “Install project dependencies” or “Set up this project.” If a victim Ctrl+clicks this link in a source file, the editor can be instructed to install a malicious VSIX package located within the project folder itself.

VS Code extensions are powerful; they can execute JavaScript or TypeScript code with the permissions of the logged-in user. This means a malicious extension could gain broad access to local files, sensitive source code, SSH keys, cloud credentials, browser-accessible tokens, and other critical development tools.

The danger extends beyond the initial compromise. Once installed, a malicious extension can persist on the system and activate during subsequent VS Code sessions. Even if the victim closes the malicious project, reboots their computer, and later opens a trusted repository, the attacker’s extension can continue to load and operate in the background.

This vulnerability is particularly concerning for developer workstations, which often serve as gateways to private repositories, CI/CD systems, code signing infrastructure, cloud accounts, and production secrets. Compromising a single developer device can therefore become the initial vector for a larger software supply-chain attack.

Microsoft’s documentation for Workspace Trust notes that users might be prompted to trust a workspace or install an extension when operating in Restricted Mode. Extensions that do not support Workspace Trust are supposed to be installed with limited functionality or disabled. However, according to Remedio Research, a crafted local VSIX extension can falsely declare support for untrusted workspaces. If VS Code accepts this declaration without presenting a clear security warning, the attacker can install the extension while the workspace ostensibly remains untrusted.

The incident highlights a broader principle: security boundaries must be applied consistently. Blocking dangerous command links in a rendered Markdown preview is insufficient if the same link can still be executed directly through the raw source editor.

What You Should Do

• Avoid Clicking Suspicious Links: Exercise extreme caution with links found in unfamiliar repositories, especially those purporting to install dependencies, configure environments, or initiate project setup actions.
• Disable Editor Links: Implement the user setting "editor.links": false in your VS Code configuration. This prevents the editor from automatically detecting and making links clickable, thereby neutralizing the attack vector.
• Maintain Workspace Trust: Keep Workspace Trust enabled for all projects and rigorously review any prompts to trust unknown workspaces.
• Regularly Review Extensions: Periodically audit your installed VS Code extensions, ensuring only legitimate and necessary extensions from trusted publishers are present.
• Restrict Extension Installation: For organizational environments, implement centralized policies to restrict extension installation to approved publishers or specific extensions.
• Treat Untrusted Code as Hostile: Until Microsoft fully addresses the consistent handling of command links across all editor interfaces, developers should assume that any links in untrusted code repositories are potentially malicious.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.