CVE-2022-30129
Published: 10 May 2022
Summary
CVE-2022-30129 is a high-severity an unspecified weakness vulnerability in Microsoft Visual Studio Code. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 2.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-30129 is a remote code execution vulnerability affecting Visual Studio Code. It carries a CVSS 3.1 base score of 8.8 with an attack vector of network, low complexity, no required privileges, and required user interaction, resulting in high impact to confidentiality, integrity, and availability.
An attacker can exploit the flaw over the network without authentication to achieve arbitrary code execution on a target system, provided the victim interacts with a malicious artifact such as a crafted workspace or repository.
Microsoft security advisories published at the listed MSRC URLs describe the issue and direct administrators to apply the corresponding Visual Studio Code updates. The SonarSource reference provides additional technical analysis of the underlying argument-injection vector.
The EPSS score reached a peak of 0.3902 and remains at that level, indicating sustained exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-35337
Vulnerability details
Visual Studio Code Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.