One Click in a Malicious VS Code Project Can Give Attackers Persistent Access to Your PC
Remedio researchers show crafted command: links in VS Code source editors can bypass Workspace Trust to install malicious extensions for persistent access.
Remedio researchers found that clickable command: URLs in VS Code source editors can invoke internal commands such as workbench.extensions.installExtension, installing a malicious VSIX from the project folder even while the workspace is in Restricted Mode. The extension runs JavaScript with logged-in user permissions and persists across sessions, exposing SSH keys, cloud credentials, and CI/CD secrets on developer workstations. No CVE is assigned and no active exploitation is reported; mitigation includes setting editor.links to false and restricting extension installation via policy.
- Command: links in the raw source editor bypass Workspace Trust Restricted Mode
- workbench.extensions.installExtension can install a local VSIX with one Ctrl+click
- Malicious extension persists across sessions with user-level permissions
- One developer compromise can seed a broader software supply-chain incident
- Mitigation: set editor.links to false and enforce extension allowlists
From the original article
3 min read at cybersecuritynews.com
A serious Visual Studio Code security issue could let attackers gain persistent access to a developer’s workstation with a single click inside a malicious project folder. The attack abuses clickable links in VS Code’s source editor to bypass the protection expected from Workspace Trust. Workspace Trust is designed to protect users when they open code […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.