Sanitize notebook mime types in error messages

[mjbvz]

VS Code - Remote Code Execution Vulnerability

A remote code execution vulnerability exists in VS Code 1.74.2 and earlier versions where opening a maliciously crafted notebook allows script execution inside of notebook's iframe. This works in untrusted workspaces and only requires that the user open the notebook. The executed script is run inside of an isolated iframe, however it is possible an attacker could combine this with additional exploits to break out of the iframe

Patches

The fix is available starting with VS Code 1.74.3. The fix (5b8361b) mitigates this attack by more safely constructing html instead

Workarounds

Do not open notebooks from untrusted sources

References

• The patch for this can be found at 5b8361b
• An advisory for this can be found at GHSA-p996-wrgh-crrj
• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21779