@wdormann @ajn142 @ifin Oh, who is the "them" in this case? I guess I lost the context somewhere, it's been a week. In VSCode it runs immediately, and then keeps running it every time you interact with VSCode. Doesn't seem right. I need to try it with an absolutely vanilla vscode install though. That's a heavier lift for me right this moment.
25
Replies
·
0
Boosts
My comment is that Mindgard did a less-than-stellar job in conveying the vulnerability in a way that somebody attempting to reproduce it can.
By leaving out the "You must wait 30 minutes for git.exe to launch", they perhaps caused some people (such as myself) to move on and think that it's not legit.
But now that I'm re-reading this thread I'm seeing that there's an iFin writeup that's talking about the VSCode side of things.
@mttaggart Confirmed that exiting restricted mode launched calc multiple times instantly.
@mttaggart @ajn142 @Sempf @ifin
Hm, I've got 6 VMs running (with different properties, e.g. trusted vs. not, actual git directory vs. not, git.exe installed vs. not) and have yet to see a git.exe launch from the project directory.
Note that these are all click-through-the-installer installs on a clean Win11 VM. No optional features, no github integration, etc.
We'll see what happens at the 30-minute mark.
@mttaggart @ajn142 @Sempf @ifin
Even after 30 minutes, I have no execution of git.exe from my repo directory. Even after exiting restricted mode.
If there's a way to repro this with a clean install of VS Code in a clean Win11 VM, then I suppose more guidance might needed to share what the trigger is.
