CVE-2022-0671: SSRF/DoS in VS Code XML Extension

The vulnerability allows an attacker to induce the vscode-xml extension to download a large file from an arbitrary URL. This can lead to a denial-of-service condition by consuming excessive network bandwidth and server resources. More concerningly, the SSRF aspect allows an attacker to potentially access internal resources that the VS Code instance has access to, bypassing security controls. This could involve reading sensitive configuration files, accessing internal APIs, or even interacting with other services within the network. The impact is amplified if the VS Code instance is running with elevated privileges or has access to sensitive data. While no direct exploitation has been publicly reported, the SSRF component presents a significant risk due to its potential for data exfiltration and lateral movement.

1. Reserved2022-02-17
2. Published2022-02-19
3. Modified2023-11-08
4. EPSS updated2026-04-02

The primary mitigation for CVE-2022-0671 is to immediately upgrade the vscode-xml extension to version 0.19.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the schema download functionality within the extension's settings. Network-level controls, such as a Web Application Firewall (WAF), can be configured to block requests to suspicious URLs or limit the size of downloaded files. Monitor VS Code instances for unusual network activity or resource consumption. After upgrading, confirm the fix by attempting to trigger a schema download from a known-safe URL and verifying that the download completes without errors or excessive resource usage.