eslint-plugin-mozilla (>=2.7.0 <=2.9.2), gatsby (>=2.24.6-telemetry-test.19 <=2.24.6-telemetry-test.20) +3 more potentially affected by CVE-2020-28448 via multi-ini (=2.1.0)

multi-ini NPM version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on multi-ini and may be impacted: - eslint-plugin-mozilla =2.7.0, =2.24.6-telemetry-test.19, =2.12.64-telemetry-test.19, =0.1.54-telemetry-test.19, =1.3.21-telemetry-test.19,...

02strich-markdown (>=1.0.0 <=1.0.2), 10secondsofcode-custom (=1.0.0) +11494 more potentially affected by CVE-2020-7753 via trim (=0.0.1)

trim NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on trim and may be impacted: - 02strich-markdown =1.0.0, =1.0.0, =0.0.2, =0.0.1, =4.11.0, =0.1.0, =0.0.2, =0.2.0, =1.0.16, =1.2.0, =1.2.2 and more Source cves: CVE-2020-7753 Source...

Malicious Package in eslint-config-airbnb-standard

Version 2.0.0 of eslint-config-airbnb-standard was published with a bundled version of eslint-scope that was found to contain malicious code. This code would read the users .npmrc file and send it's contents to a remote server. Recommendation The best course of action if you found this package...

GHSA-M852-866J-69J8 Malicious Package in eslint-config-airbnb-standard

Version 2.0.0 of eslint-config-airbnb-standard was published with a bundled version of eslint-scope that was found to contain malicious code. This code would read the users .npmrc file and send it's contents to a remote server. Recommendation The best course of action if you found this package...

Malicious Package in eslint-config-eslint

Version 5.0.2 of eslint-config-eslint was published without authorization and was found to contain malicious code. This code would read the users .npmrc file and send any found authentication tokens to a remote server. Recommendation The best course of action if you found this package installed i...

GHSA-PV55-R6J3-WP94 Malicious Package in eslint-config-eslint

Version 5.0.2 of eslint-config-eslint was published without authorization and was found to contain malicious code. This code would read the users .npmrc file and send any found authentication tokens to a remote server. Recommendation The best course of action if you found this package installed i...

The vulnerability of the Microsoft Visual Studio Code ESLint Extension lies in the insufficient data validation when opening a project, allowing a malicious actor to execute arbitrary code.

The vulnerability of the Microsoft Visual Studio Code ESLint Extension lies in the insufficient data validation when opening a project. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

@albalyu/npm-scripts (>=2.0.1 <=2.0.40), @opuscapita/eslint-config-opuscapita-bnapp (>=1.0.1 <=1.0.6) +7 more potentially affected by CVE-2020-36632 via flat (=3.0.0)

flat NPM version =3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flat and may be impacted: - @albalyu/npm-scripts =2.0.1, =1.0.1, =2.2.1, =2.0.0, =0.0.1-beta.2, =4.0.1, =0.3.0-beta.16, =0.3.0-beta.83 Source cves: CVE-2020-36632 Source advisory:...

Microsoft Visual Studio Code ESLint Extention Command Injection Vulnerability

Microsoft Visual Studio Code is an open source code editor from Microsoft USA. A command injection vulnerability exists in Microsoft Visual Studio Code ESLint Extention. An attacker can exploit this vulnerability to run arbitrary code in the context of the current user...

Security Update for Microsoft Visual Studio Code ESLint Extension (July 2020)

An input-validation flaw exists in Visual Studio Code Live Share Extension related to handling source code validation upon project opening that allows remote code execution. An attacker can convince a user to clone a specified repository and to open it in Visual Studio Code leading to code...

CVE-2020-1481

A remote code execution vulnerability exists in the ESLint extension for Visual Studio Code when it validates source code after opening a project, aka 'Visual Studio Code ESLint Extention Remote Code Execution Vulnerability'...

CVE-2020-1481

A remote code execution vulnerability exists in the ESLint extension for Visual Studio Code when it validates source code after opening a project, aka 'Visual Studio Code ESLint Extention Remote Code Execution Vulnerability'...

Remote code execution

A remote code execution vulnerability exists in the ESLint extension for Visual Studio Code when it validates source code after opening a project, aka 'Visual Studio Code ESLint Extention Remote Code Execution Vulnerability'...

CVE-2020-1481

A remote code execution vulnerability exists in the ESLint extension for Visual Studio Code when it validates source code after opening a project, aka 'Visual Studio Code ESLint Extention Remote Code Execution Vulnerability'...

CVE-2020-1481

The CVE-2020-1481 entry concerns a remote code execution in the Visual Studio Code ESLint Extension. The vulnerability arises when the ESLint extension validates source code after opening a project, enabling attacker-specified code to run in the user’s context if a target clones a repository and ...

Visual Studio Code ESLint Extension Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the ESLint extension for Visual Studio Code when it validates source code after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on...

PT-2020-3300 · Microsoft · Visual Studio Code Eslint Extension

Name of the Vulnerable Software and Affected Versions: ESLint extension for Visual Studio Code affected versions not specified Description: A remote code execution issue exists in the ESLint extension for Visual Studio Code. This occurs when the extension validates source code after a project is...

KLA11859 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Windows Diagnostics Hub...

compare-eslint-config (>=0.1.0 <=0.1.1) potentially affected by CVE-2020-7629 via install-package (=0.1.0)

install-package NPM version =0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on install-package and may be impacted: - compare-eslint-config =0.1.0, =0.1.1 Source cves: CVE-2020-7629 Source advisory: SNYK:JS-INSTALLPACKAGE-564267...

Withdrawn: ESLint dependencies are vulnerable (ReDoS and Prototype Pollution)

Withdrawn GitHub has withdrawn this advisory in place of GHSA-vh95-rmgr-6w4m and GHSA-6chw-6frg-f759. The reason for withdrawing is that some mistakes were made during the ingestion of CVE-2020-7598 which caused this advisory to be published with incorrect information. In order to provide accurat...