An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recommend upgrading to version 0.4.1 or above.
Metrics
Affected Vendors & Products
References
History
No history.

Status: PUBLISHED
Assigner: Google
Published: 2021-04-16T10:15:12.912725Z
Updated: 2024-09-17T01:46:31.592Z
Reserved: 2021-01-05T00:00:00
Link: CVE-2021-22539

No data.

Status : Modified
Published: 2021-04-16T11:15:12.637
Modified: 2024-11-21T05:50:18.043
Link: CVE-2021-22539

No data.