PT-2021-18765 · Unknown · Vscode-Ghc-Simple

Ryotak · Published 2021-04-25 · Updated 2021-05-07 · CVE-2021-30502

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vscode-ghc-simple extension versions prior to 0.2.3

Description The issue allows remote code execution via a crafted workspace configuration with replCommand. This can be exploited by an attacker to execute malicious code.

Recommendations For versions prior to 0.2.3, update to version 0.2.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the replCommand in workspace configurations until the update is applied.

Fix

Related Identifiers

CVE-2021-30502

Affected Products

Vscode-Ghc-Simple

References · 8

• https://github.com/dramforever/vscode-ghc-simple/commit/bc7f6f0b857dade46ea51496d8bd1a4edef39b46 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-30502 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30502 · Vendor Advisory
• https://github.com/dramforever/vscode-ghc-simple/releases · Note
• https://github.com/dramforever/vscode-ghc-simple/blob/master/CHANGELOG.md#v023 · Note
• https://t.me/cvenotify/13720 · Telegram Post
• https://vuln.ryotak.me/advisories/38 · Note
• https://t.me/cvenotify/13677 · Telegram Post