CVE-2020-17023: Visual Studio Code RCE Vulnerability

CVE-2020-17023 Overview

A remote code execution vulnerability exists in Microsoft Visual Studio Code when a user is tricked into opening a malicious package.json file. An attacker who successfully exploits this vulnerability could execute arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take complete control of the affected system, including the ability to install programs, view, change, or delete data, or create new accounts with full user rights.

To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code. The attacker-specified code would execute when the target opens the malicious package.json file, making this a social engineering-dependent attack vector.

Critical Impact

Successful exploitation allows arbitrary code execution with the privileges of the current user, potentially leading to full system compromise if the user has administrative rights.

Affected Products

• Microsoft Visual Studio Code (all versions prior to the security patch)

Discovery Timeline

• 2020-10-16 - CVE-2020-17023 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2020-17023

Vulnerability Analysis

This vulnerability represents a code injection attack targeting Visual Studio Code's JSON file parsing functionality. When VS Code processes a package.json file, improper handling of the file contents allows specially crafted data to trigger code execution. The attack requires user interaction, specifically opening a malicious file within the VS Code environment, making it a local attack vector that relies on social engineering techniques.

The impact is severe because developers frequently clone repositories from various sources and open them in VS Code without thorough inspection. The package.json file is a ubiquitous component of Node.js and npm projects, making it an ideal attack vector as it's typically one of the first files examined when reviewing a new project.

Root Cause

The root cause of this vulnerability lies in the way Visual Studio Code handles and processes JSON files, specifically package.json. The application failed to properly sanitize or validate the contents of these configuration files before processing them, allowing malicious payloads embedded within the JSON structure to execute code. Microsoft addressed this by modifying how Visual Studio Code handles JSON files to prevent arbitrary code execution during file parsing.

Attack Vector

The attack vector requires an attacker to craft a malicious repository containing a specially crafted package.json file. The attack sequence proceeds as follows:

1. Attacker creates a malicious repository with a weaponized package.json file
2. Attacker convinces the victim to clone the repository (via phishing, social engineering, or compromising a legitimate-looking project)
3. Victim opens the cloned project in Visual Studio Code
4. Upon opening or parsing the package.json file, the malicious code executes
5. Attacker gains code execution with the privileges of the victim user

This local attack vector requires user interaction but has a low attack complexity once the victim opens the malicious file. The vulnerability does not require any prior privileges on the target system.

Detection Methods for CVE-2020-17023

Indicators of Compromise

• Unusual child processes spawned by Visual Studio Code (code.exe or code on Linux/macOS)
• Unexpected network connections originating from the VS Code process
• Suspicious package.json files in recently cloned repositories containing encoded payloads or unusual JSON structures
• Anomalous file system modifications or registry changes following VS Code file operations

Detection Strategies

• Monitor for child process creation events where the parent process is Visual Studio Code, especially command shells or script interpreters
• Implement endpoint detection rules to alert on VS Code spawning unexpected executables
• Deploy file integrity monitoring on development environments to detect unauthorized changes
• Use static analysis tools to scan package.json files in repositories before opening

Monitoring Recommendations

• Enable detailed logging for Visual Studio Code processes in enterprise environments
• Configure SIEM rules to correlate VS Code process activity with network connections and file modifications
• Implement repository scanning pipelines that analyze package.json files for suspicious content before developer access
• Monitor for signs of code execution following git clone operations

How to Mitigate CVE-2020-17023

Immediate Actions Required

• Update Visual Studio Code to the latest version that includes the security patch
• Avoid opening untrusted repositories or package.json files from unknown sources
• Run Visual Studio Code with minimal required privileges (non-administrative accounts)
• Review recently cloned repositories for suspicious package.json content
• Enable VS Code's Trust feature for workspaces to restrict code execution in untrusted folders

Patch Information

Microsoft has released a security update that addresses this vulnerability by modifying the way Visual Studio Code handles JSON files. Users should update to the latest version of Visual Studio Code through the built-in update mechanism or by downloading the latest installer from the official Microsoft website. For detailed patch information, refer to the Microsoft Security Advisory CVE-2020-17023.

Workarounds

• Enable VS Code Workspace Trust feature to restrict code execution in untrusted folders
• Use virtual machines or containers when reviewing code from untrusted sources
• Implement organizational policies requiring code review of package.json files before opening in VS Code
• Consider using alternative text editors to inspect suspicious JSON files before opening projects in VS Code