CVE-2023-46248

Summary

CVE-2023-46248 is a critical Remote Code Execution vulnerability affecting versions 0.10.0 through 0.14.0 of the Cody AI VSCode extension. An attacker with control over a malicious repository can modify the `.vscode/cody.json` file and overwrite Cody commands. If a user opens the malicious repository and runs a Cody command, such as /explain or /doc, the attacker can execute arbitrary code on the user's machine. The vulnerability is exploitable even if the user blocks code execution on a repository through VS Code Workspace Trust. The maintainers of Cody recommend users not to open any untrusted repositories with the Cody extension loaded until they have upgraded to version 0.14.1. The issue was identified during a routine penetration test and has not been observed in open source repositories to date.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.