CVE-2023-46248
📋 TL;DR
The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to remote code execution when users open malicious repositories containing a modified .vscode/cody.json configuration file. Attackers who control a repository can overwrite Cody commands to execute arbitrary code on the victim's machine when they run commands like /explain or /doc. This affects developers using the vulnerable Cody extension in Visual Studio Code.
💻 Affected Systems
- Cody AI VSCode Extension
📦 What is this software?
Cody by Sourcegraph
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the developer's machine, allowing attackers to execute arbitrary code, steal credentials, install malware, or pivot to internal networks.
Likely Case
Limited targeted attacks against developers who open malicious repositories, potentially leading to credential theft or malware installation.
If Mitigated
No impact if users upgrade to patched version or avoid untrusted repositories.
🎯 Exploit Status
Requires attacker to control repository and victim to open it and execute Cody command. No evidence of malicious repositories in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.14.1
Vendor Advisory: https://github.com/sourcegraph/cody/security/advisories/GHSA-8wmq-fwv7-xmwq
Restart Required: Yes
Instructions:
1. Open VS Code. 2. Go to Extensions view. 3. Find Cody extension. 4. Click Update or reinstall. 5. Restart VS Code.
🔧 Temporary Workarounds
Disable Cody Extension
allTemporarily disable the Cody extension until patched.
code --disable-extension sourcegraph.cody-ai
🧯 If You Can't Patch
- Do not open untrusted repositories with Cody extension loaded.
- Disable Cody extension when working with unknown repositories.
🔍 How to Verify
Check if Vulnerable:
Check Cody extension version in VS Code Extensions view. If version is between 0.10.0 and 0.14.0 inclusive, you are vulnerable.Check Version:
code --list-extensions --show-versions | grep codyVerify Fix Applied:
Verify Cody extension version is 0.14.1 or higher in VS Code Extensions view.📡 Detection & Monitoring
Log Indicators:
- Unusual Cody command executions
- Modifications to .vscode/cody.json files
Network Indicators:
- Downloads from untrusted repositories with Cody configuration files
SIEM Query:
process.name:"code" AND file.path:"*/.vscode/cody.json" AND file.modified:true