CVE-2023-46248
CVSS 3.1 Score 8.8 of 10 (high)
Details
Summary
CVE-2023-46248 is a critical Remote Code Execution vulnerability affecting versions 0.10.0 through 0.14.0 of the Cody AI VSCode extension. An attacker with control over a malicious repository can modify the `.vscode/cody.json` file and overwrite Cody commands. If a user opens the malicious repository and runs a Cody command, such as /explain or /doc, the attacker can execute arbitrary code on the user's machine. The vulnerability is exploitable even if the user blocks code execution on a repository through VS Code Workspace Trust. The maintainers of Cody recommend users not to open any untrusted repositories with the Cody extension loaded until they have upgraded to version 0.14.1. The issue was identified during a routine penetration test and has not been observed in open source repositories to date.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- SourceGraph
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions