CVE-2020-0604: 
Visual Studio Code vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-0604) exists in Visual Studio Code when it processes environment variables after opening a project. The vulnerability was disclosed and tracked by Microsoft, affecting Visual Studio Code versions up to (excluding) 0.24.0 (NVD).

The vulnerability received a CVSS v3.1 base score of 8.8 (HIGH) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, while Microsoft assessed it with a score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The CVSS v2.0 base score was 9.3 (HIGH) with vector (AV:N/AC:M/Au:N/C:C/I:C/A:C) (NVD).

An attacker who successfully exploits this vulnerability could run arbitrary code in the context of the current user. If the current user has administrative rights, the attacker could take control of the affected system, install programs, view or modify data, and create new accounts with full user rights (NVD).

To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code. The attacker-specified code would execute when the target opened the integrated terminal (NVD).

Microsoft addressed the vulnerability by modifying the way Visual Studio Code handles environment variables. Users should update to the latest version of Visual Studio Code that contains the security fix (NVD).