Escaping Misconfigured VSCode Extensions
Summary
The Trail of Bits analysis examines misconfigurations in VSCode Webviews and three vulnerabilities in VSCode extensions (SARIF Viewer and Live Preview) that could lead to local file exfiltration, including DNS-based leakage and a path-traversal flaw in a local HTTP server. It provides defense-focused guidance for securing Webviews, CSP, resource access, and local servers, and notes a follow-up on a VSCode sandbox escape bug.