CVE-2021-22539
High
Description
An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recommend upgrading to version 0.4.1 or above.
SeverityHigh
CVSS8.2
Exploit probability—
Product
Google Bazel
PublishedApr 16, 2021
First seenApr 16, 2021
Weakness typeCWE-73CWE-73
How to fix
Update
- google bazel0.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google bazel | 0.1.0 ≤ v < 0.4.1 | 0.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.