Visual Studio Code Live Preview Extension
Monthly
Path traversal in the Visual Studio Code Live Preview extension (versions 0.4.0 through 0.4.18) enables a local attacker to read arbitrary files outside the intended workspace directory by exploiting insufficient path validation in the extension's embedded HTTP server. The flaw (CWE-23) can expose sensitive local files such as credentials or private keys to any party who can supply a crafted file to a developer and have them trigger the preview feature. No public exploit code exists and the vulnerability is absent from CISA KEV; Microsoft has released a fix in version 0.4.19.
Path traversal in the Visual Studio Code Live Preview extension (versions 0.4.0 through 0.4.18) enables a local attacker to read arbitrary files outside the intended workspace directory by exploiting insufficient path validation in the extension's embedded HTTP server. The flaw (CWE-23) can expose sensitive local files such as credentials or private keys to any party who can supply a crafted file to a developer and have them trigger the preview feature. No public exploit code exists and the vulnerability is absent from CISA KEV; Microsoft has released a fix in version 0.4.19.