See how @lucacarettoni leveraged newly public bugs and techniques, along with (un)fortunate design choices to elevate an XSS discovered by @justinsteven into a full-blown RCE in VSCode, via its support for Jupyter Notebook.