The unofficial vscode-rpm-spec extension prior to 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configuration.