CVE-2022-41083: VS Code Jupyter ext: local privilege escalation

HIGH

Published October 11, 2022

CISO Take

CVE-2022-41083 is a local elevation-of-privilege flaw in the Jupyter Extension for Visual Studio Code, patched by Microsoft in October 2022. Exploitation requires an attacker who already has low-privilege local code execution and no user interaction, so it is a post-compromise escalation step, not an initial-access vector. Exploitation likelihood looks low: it is not in CISA KEV, there is no public exploit or Nuclei template, and EPSS and SSVC data are unavailable. The exposure is wide, though, with 1,881 downstream dependents, and the package has 45 other CVEs and an OpenSSF Scorecard of 5.8/10. Confirm that every developer workstation, shared notebook host and remote dev environment runs the current Jupyter extension and VS Code builds, and treat any unpatched shared multi-user system as higher priority.

Sources:NVDMicrosoft MSRC (msrc.microsoft.com)OpenSSFATLAS

What is the risk?

Medium overall. The CVSS 7.8 score reflects high confidentiality, integrity and availability impact, but the attack is local and needs prior low-privilege access. The vector marks exploit code maturity as unproven and the fix as an official one. There is no KEV listing, no public exploit and no scanner template. The risk is highest on shared data-science hosts, multi-tenant notebook servers and developer machines holding model artifacts, credentials and API keys.

How does the attack unfold?

Initial Foothold

The attacker obtains low-privilege local code execution on a developer or notebook host.

AML.T0011.001

Exploitation

The attacker abuses the vulnerable Jupyter extension for VS Code to escalate privileges locally with no user interaction.

AML.T0112

Credential and Artifact Access

With elevated rights, the attacker collects credentials, datasets and model files from the host.

AML.T0037

Impact

The attacker tampers with ML pipelines or exfiltrates proprietary models and data, with high confidentiality, integrity and availability impact.

Initial Foothold

The attacker obtains low-privilege local code execution on a developer or notebook host.

AML.T0011.001

Exploitation

The attacker abuses the vulnerable Jupyter extension for VS Code to escalate privileges locally with no user interaction.

AML.T0112

Credential and Artifact Access

With elevated rights, the attacker collects credentials, datasets and model files from the host.

AML.T0037

Impact

The attacker tampers with ML pipelines or exfiltrates proprietary models and data, with high confidentiality, integrity and availability impact.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter	pip	—	No patch
13.5KOpenSSF 5.81.9K dependentsPushed 3d ago57% patched~28d to patchFull package profile →
Jupyter	pip	—	No patch
13.5KOpenSSF 5.81.9K dependentsPushed 3d ago57% patched~28d to patchFull package profile →

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVLocal

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Update VS Code and the Jupyter extension to the versions listed in Microsoft's MSRC advisory for CVE-2022-41083. 2) Inventory extension versions across developer endpoints and remote or shared notebook hosts, using endpoint management or the code --list-extensions --show-versions command. 3) Enforce least privilege on dev hosts and avoid running notebooks as an administrator or root user. 4) Restrict extension installation to an approved marketplace allowlist. 5) Monitor for unexpected privilege changes and child processes spawned by VS Code or its extension host. 6) Keep secrets out of notebook working directories and use short-lived credentials.

How is it classified?

Code ExecutionFrameworkPluginAML.T0010.001- AI Software AML.T0112- Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to identified AI risks

Frequently Asked Questions

What is CVE-2022-41083?

Is CVE-2022-41083 actively exploited?

No confirmed active exploitation of CVE-2022-41083 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-41083?

1) Update VS Code and the Jupyter extension to the versions listed in Microsoft's MSRC advisory for CVE-2022-41083. 2) Inventory extension versions across developer endpoints and remote or shared notebook hosts, using endpoint management or the `code --list-extensions --show-versions` command. 3) Enforce least privilege on dev hosts and avoid running notebooks as an administrator or root user. 4) Restrict extension installation to an approved marketplace allowlist. 5) Monitor for unexpected privilege changes and child processes spawned by VS Code or its extension host. 6) Keep secrets out of notebook working directories and use short-lived credentials.

What systems are affected by CVE-2022-41083?

This vulnerability affects the following AI/ML architecture patterns: Developer workstations, Notebook-based training pipelines, Shared data-science environments, Remote development environments.

What is the CVSS score for CVE-2022-41083?

CVE-2022-41083 has a CVSS v3.1 base score of 7.8 (HIGH).

What is the AI security impact?

Affected AI Architectures

Developer workstationsNotebook-based training pipelinesShared data-science environmentsRemote development environments

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0112Machine Compromise

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Visual Studio Code Elevation of Privilege Vulnerability

Exploitation Scenario

An attacker gains a low-privilege foothold on a data scientist's workstation or a shared GPU notebook server, for example through a malicious pip package or a phished session. They then abuse the vulnerable Jupyter extension component to run code with higher privileges. With elevated rights they read other users' notebooks, model weights and cloud credentials. They can also modify training scripts or datasets, or move laterally into the ML platform.