The remote code execution bug, tracked as CVE-2020-1192, is exposed when Microsoft's VS Code Python extension loads workspace settings from a file from a notebook, such as Jupyter.

When Python for Windows is installed, it will associate the .pyzw file extension with the Python executable, causing Python to execute the scripts automatically when the file is double-clicked.