3 ms·
Several days after RCE disclosure and the best they can do is forum reply "yes we know, no ETA for a fix"? No security advisory, no immediate workaround suggest
by progbits 5y ago
Several days after RCE disclosure and the best they can do is forum reply "yes we know, no ETA for a fix"? No security advisory, no immediate workaround suggested?
- ribit 5y agoI am not sure what kind of security advisory would be helpful here? It's software you run locally, not something on a public server. How would anyone exploit this unless you are in a habit of running untrusted software on your local machine? And in the latter case, this vulnerability is probably the last of your worries.
- progbits 5y agoDepends on what they log, could be controllable by the code you open in xcode. For example if you clone and open (not necessarily even run) a malicious github repo. VS code asks you if you trust the code you are opening for example and if not it turns into dumb editor mode for this sort of reason.