PT-2021-18387 · Unknown · Vscode-Rufo

Ryotak · Published 2021-03-31 · Updated 2022-07-12 · CVE-2021-29658

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vscode-rufo extension versions prior to 0.0.4

Description The issue allows attackers to execute arbitrary binaries if the user opens a crafted workspace folder. This can be exploited when a user opens a specifically designed workspace folder, potentially leading to malicious binary execution.

Recommendations For versions prior to 0.0.4, update to version 0.0.4 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted workspace folders until the update is applied.

Fix

Related Identifiers

CVE-2021-29658

Affected Products

Vscode-Rufo

References · 8

• https://github.com/jnbt/vscode-rufo/commit/bc0d212436f76d12cbdab287802fa5bc743f818a · Patch
• https://osv.dev/vulnerability/CVE-2021-29658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29658 · Security Note
• https://marketplace.visualstudio.com/items/jnbt.vscode-rufo/changelog · Note
• https://t.me/cvenotify/12402 · Telegram Post
• https://t.me/cvenotify/12637 · Telegram Post
• https://vuln.ryotak.me/advisories/8 · Note
• https://t.me/cvenotify/12745 · Telegram Post