Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NSummary
CVE-2023-33144 is a medium-severity Relative Path Traversal (CWE-23) vulnerability in Microsoft Visual Studio Code. Its CVSS base score is 6.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 33% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-33144 is a spoofing vulnerability affecting Visual Studio Code, assigned CWE-23 for relative path traversal. It carries a CVSS 3.1 base score of 6.6 reflecting local attack vector, low attack complexity, low privileges required, and required user interaction, resulting in high impact to confidentiality and integrity with no availability effect.
An attacker with local access and limited privileges can exploit the flaw by presenting a crafted resource that the victim is tricked into opening or interacting with inside Visual Studio Code, enabling unauthorized disclosure or modification of files on the system.
Microsoft has published guidance for the issue in its Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33144.
The EPSS score for this CVE rose materially from a low baseline to a peak of 0.0762 on 2025-01-22 before receding to its current value of 0.0072, indicating a period of increased exploitation interest after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-37329
Vulnerability Data
Visual Studio Code Spoofing Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that prevent relative traversal.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis, but does not itself implement the fix.
Secure development lifecycle mandates input validation and path-handling controls that directly prevent relative path traversal.
Application security requirements explicitly call for controls against path traversal and other injection flaws.
Secure architecture principles include directory isolation and canonicalization, reducing but not eliminating traversal risk.
Secure coding standards require neutralizing path traversal sequences, directly addressing CWE-23.
Information access restriction limits which files can be reached, mitigating impact but not preventing the traversal flaw.