Loading vulnerability…
CVE-2021-43908 is a remote code execution vulnerability in Visual Studio Code’s Markdown preview handling that remains exploitable in Restricted Mode. A malicious project or folder containing a Markdown file can abuse the markdown-preview webview, a postMessage origin-validation weakness, and a path traversal flaw in the vscode-file handler. The traversal permits attacker-controlled HTML outside the intended Visual Studio Code installation directory to be loaded in a vscode-file context with Node.js integration, enabling execution of system commands.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository demonstrates an operational exploit for CVE-2021-43908, a remote code execution vulnerability in Visual Studio Code's webview implementation. The exploit consists of a Node.js Express server (code/main.js) that serves malicious HTML and JavaScript payloads. The attack is initiated by tricking a victim into opening a crafted markdown file (exploit.md), which loads a remote font from the attacker's server. This request leaks the victim's VSCode extension ID via the Origin header. The victim is then redirected to a further payload (rce.html) that, when loaded in the vulnerable webview context, executes arbitrary system commands (opening the calculator) using Node.js APIs exposed in the Electron environment. The repository includes the main exploit server code, the crafted markdown and HTML payloads, and supporting files. The attack vector is browser-based, targeting users of vulnerable VSCode installations on both Windows and macOS. The endpoints used are all hosted on the attacker's server (felineintelligentbytes.kacegi6947.repl.co), which collects leaked data and serves the exploit payloads.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Visual Studio Code path traversal vulnerability referenced as prior research and used to load arbitrary files outside the VSCode installation path.
A remote code execution vulnerability in Visual Studio Code Restricted Mode that can be triggered by opening a maliciously crafted Markdown file in a VSCode project or folder. The exploit chain described uses origin leakage, webview postMessage abuse, XSS in vscode-webview, and path traversal into vscode-file to achieve Node.js code execution.
A spoofing vulnerability in Visual Studio Code.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.