PT-2020-4390 · Microsoft · Visual Studio Code

Published 2020-10-13 · Updated 2023-12-31 · CVE-2020-16977

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Visual Studio Code (affected versions not specified)

Description: A remote code execution issue exists when the Python extension loads a Jupyter notebook file, allowing an attacker to run arbitrary code in the context of the current user. If the user has administrative rights, the attacker could take control of the system, install programs, view, change, or delete data, or create new accounts. To exploit this, an attacker must convince a target to open a specially crafted file in Visual Studio Code with the Python extension installed.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2020-04903

CVE-2020-16977

Affected Products

Visual Studio Code

References · 4

• https://bdu.fstec.ru/vul/2020-04903 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-16977 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16977 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16977 · Vendor Advisory