CVE-2020-1171 Visual Studio Code Python Extension Remote Code Execution Vulnerability
Attackers can execute arbitrary code by tricking users into opening a malicious project in VS Code with the Python extension installed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-1171?
CVE-2020-1171 is a high-severity code injection vulnerability in Microsoft Python extension for Visual Studio Code, published on 21 May 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code with the Python extension installed. Attacker-specified code would execute when the target opened the integrated terminal. The update address the vulnerability by modifying the way Visual Studio Code Python extension handles environment variables.
Which versions are affected by CVE-2020-1171?
It affects 1 product.
Products include Microsoft Python.
How do I fix CVE-2020-1171?
No fix has been published for CVE-2020-1171 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-1171 being exploited?
There is no known exploitation of CVE-2020-1171 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Python extension for Visual Studio Code
- CVE-2024-49050 Visual Studio Code Python Extension Remote Code Execution Vulnerability
- CVE-2026-54981 Visual Studio Code Python Extension Security Feature Bypass Vulnerability
- CVE-2025-49714 Visual Studio Code Python Extension Remote Code Execution Vulnerability
- CVE-2020-17163 Visual Studio Code Python Extension Remote Code Execution Vulnerability
- CVE-2020-1192 Visual Studio Code Python Extension Remote Code Execution Vulnerability
Sources
Also known as GHSA-v7q9-qwmc-9665.