The vulnerability arises from InsightVM assessment content versions at or below 0.0.261.0 used by Rapid7 Insight Agent on Windows. The assessment content invoked the 'code' command without a fully qualified path from a SYSTEM process. Because the command resolution uses the machine PATH environment variable, if the PATH contains a directory writable by non-administrative users and that directory precedes the legitimate Visual Studio Code installation, a local user can plant a malicious executable named 'code'. This executable will then be executed with SYSTEM privileges, allowing arbitrary code execution. The vulnerability is classified as CWE-427 (Uncontrolled Search Path Element). The fix was introduced in assessment content version 0.0.269.0, deployed automatically via the Rapid7 Insight Platform.

A local, low-privileged user can escalate privileges to SYSTEM by exploiting the uncontrolled search path element. This allows arbitrary code execution with SYSTEM privileges, potentially leading to full system compromise. The CVSS 3.1 base score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.

The vulnerability was resolved in assessment content version 0.0.269.0, which was automatically deployed to all Insight Agents via the Rapid7 Insight Platform. No customer action is required to remediate this issue. Users should ensure their Insight Agents are running assessment content version 0.0.269.0 or later.