Attacking Language Server JSON RPC

While auditing a VSCode Extension Language Server I noticed something interesting. This turned into the research question “can we attack the extension from the browser?“. After a bit of preliminary research I decided to do it again on stream, and eventually made this video. This is how security research can look like. What is a Server? What is a Protocol? GitLab RCE Live Stream: My Font (advertisement): Chapters: 00:00 - Why Security Research? 01:23 - What is a Language Server? 02:53 - Setup Example Code 04:00 - RCE in VSCode Extension? 05:25 - The Language Server Code 06:29 - Researching Communication 11:13 - Can a Browser Attack the VSCode Extension? 13:54 - Research Results 15:40 - Ad n’ Outro =[ ❤️ Support ]= → per Video: → per Month: 2nd Channel: =[ 🐕 Social ]= → Twitter: → Streaming: → TikTok: @liveoverflow_ → Instagram: → Blog: → Subreddit: → Facebook: