CVE-2021-22539 Code execution in VSCode-bazel via malicious Bazel config files

An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint .bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recomme...

CVE-2021-22539

CVE-2021-22539 affects vscode-bazel. A crafted JSON config file in the project folder can point to a custom executable, because vscode-bazel allows the workspace path to lint *.bzl files to be set via this config. This enables execution of any executable on the system through vscode-bazel. The re...