“An attacker could, through a link or website, take over the computer of a Visual Studio Code user and any computers they were connected to via the Visual Studio Code Remote Development feature.”
Click a link, lose your machine and every server your editor was connected to. That includes GitHub Codespaces. The bug lived in VS Code’s own trust model, the thing meant to stop exactly this. Your editor is now a browser with root on production.