Google Llc Vscode-Bazel vulnerabilities

1 known vulnerability affecting google_llc/vscode-bazel.

Total CVEs

1

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

HIGH1

Vulnerabilities

Page 1 of 1

CVE-2021-22539HIGHCVSS 7.8≥ unspecified, ≤ 0.4.02021-04-16

CVE-2021-22539 [HIGH] CWE-73 CVE-2021-22539: An attacker can place a crafted JSON config file into the project folder pointing to a custom execut An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recommend upgrading to version 0.4.1 or above.