WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2023 • Sep 27, 2023

You click, you lose: a practical look at VSCode's security

Thomas Chauchefoin , Paul Gerste

Think opening a workspace in VS Code is safe? Attackers can exploit its web-based architecture to execute arbitrary code the moment you click a malicious repository link.

Pause
Mute Enter Fullscreen
#1 about 5 min

Introduction to VS Code security risks and threat models

The growing threat of targeting developers and the security trade-offs of deep IDE integrations.

#2 about 6 min

VS Code architecture and security process separation boundaries

How VS Code isolates processes using Electron, webviews, and message passing to maintain security boundaries.

#3 about 3 min

Exploiting exposed network services in developer IDE extensions

How extensions that expose local web servers and debuggers introduce critical network vulnerabilities.

#4 about 5 min

Injecting malicious arguments via OS URI protocol handlers

Bypassing operating system handlers to inject malicious arguments into background execution binaries like git.

#5 about 6 min

Exploiting malicious workspace settings and local git configurations

How workspace configurations and local git hooks can execute commands before explicit trust is granted.

#6 about 4 min

Executing cross-site scripting in web views and Markdown

Weaponizing Markdown preview components and post messages to bypass same-origin policies and trigger internal commands.

#7 about 3 min

Reporting IDE vulnerabilities and bug bounty program takeaways

Analyzing bug bounty program realities for desktop applications and why IDE security boundaries remain opaque.

Matching moments

5:44 min

Risks of malicious VS Code extensions and AI assistants

Chris Heilmann Chris Heilmann +3 · LIVE

4:51 min

Visual Studio Code as a target for exploitation

Raul Onitza-Klugman +1 · JS Congress

1:40 min

Identifying security risks in developer IDE environments

Niels Tanis Niels Tanis · World Congress 2022

2:48 min

Addressing remote code execution vulnerabilities in text editors

Chris Heilmann Chris Heilmann +2 · LIVE

5:26 min

Exploiting path traversal vulnerabilities in code editor extensions

Sonya Moisset · World Congress 2023

3:02 min

Mitigating extension vulnerabilities and applying workspace trust

Raul Onitza-Klugman +1 · JS Congress

More from World Congress 2023

The year 3000, a brief history of Web Development thumbnail
25:30
over 2 years ago

The year 3000, a brief history of Web Development

Lorenzo Pieri

Demografie nutzen um jedem Bewerber das passende Angebot zu machen! thumbnail
8:52
almost 3 years ago

Demografie nutzen um jedem Bewerber das passende Angebot zu machen!

Nathalie Gierth

Guided Memory Management: Rust's Ownership Model thumbnail
0:18
almost 3 years ago

Guided Memory Management: Rust's Ownership Model

Stefan Baumgartner

Passwordless future: WebAuthn and Passkeys in practice thumbnail
32:32
almost 3 years ago

Passwordless future: WebAuthn and Passkeys in practice

Clemens Hübner

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail
30:07
almost 3 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Building Reliable Serverless Applications with AWS CDK and Testing thumbnail
25:18
almost 3 years ago

Building Reliable Serverless Applications with AWS CDK and Testing

Raphael Manke

Related videos

Vulnerable VS Code extensions are now at your front door thumbnail
44:11
JS Congress • almost 5 years ago

Vulnerable VS Code extensions are now at your front door

Raul Onitza-Klugman, Kirill Efimov

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most thumbnail
24:33
World Congress 2026 Europe • 3 months ago

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most

Marcus Wermuth

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks thumbnail
27:10
World Congress 2023 • about 3 years ago

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks

Sonya Moisset

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail
42:55
Coffee With Developers • over 2 years ago

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

101 Typical Security Pitfalls thumbnail
28:41
World Congress 2022 • over 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.