[brainyz]

it did require to have the Remote Development Extension Pack installed right? or was the vulnerability discovered in the core VS Code?

[rs_rs_rs_rs_rs]

This is a core VS Code vulnerability, the remote development extension is mentioned because this vulnerability can be used to "take over the computer of a Visual Studio Code user and any computers they were connected to" using the remote development extension.