vscode-frida

将 Frida 集成到 VSCode 源码仓库 | GitHub Issues | 安装到 VSCode 本项目为社区贡献项目，与 Frida 官方团队无关。由 @CodeColorist 开发和维护，是一个开源的 Visual Studio Code 扩展，旨在提升 Frida 脚本开发体验。 前置要求 Python = 3.7 frida-tools Python 包 可选依赖 libimobiledevice（用于 inetcat 命令启动 SSH shell） Windows 上的 iTunes（用于 iOS USB 连接） 如果你在 Windows 上，需要保持 iTunes...

APKLab

APKLab 终极安卓逆向体验，就在你的 VS Code 中。 APKLab 将最优秀的开源工具：Apktool、smali-lsp、Jadx、uber-apk-signer、apk-mitm 等无缝集成到出色的 VS Code，让你专注于应用分析，无需离开 IDE 即可完成工作。 功能 解码/编辑/重打包应用资源文件 反汇编/修改/重打包 APK 与 Smali 互转 将 APK 反编译为 Java 源码 借助 smali-lsp 提供出色的 Smali 语言支持 —— 转到定义、查找引用、悬停提示、调用/类型层级、代码镜头、自动补全、诊断 在 VS Code 中利用完整的 IDE...

vscode-rce-electrovolt

vscode-rce-electrovolt CVE-2021-43908 https://blog.electrovolt.io/posts/vscode-rce/...

CVE-2025-55319-PoC

Reference: CVE-2025-55319 针对 HTB "Checkpoint" 挑战的 VS Code .vsix 扩展概念验证。 安装后，扩展自动激活并产生一个隐藏的 PowerShell 反向 shell 回连到攻击者。 ⚠️ 仅限授权使用。 这是一个 CTF/实验室环境产物。仅可部署在你拥有或明确授权测试（例如 HTB 目标机）的机器上。 工作原理 extension/package.json — 扩展清单。"activationEvents": "" 使它在 VS Code 加载时即刻运行，无需用户交互。 extension/extension.js — 在...

vscode-github-token-grab-extension

hello-world README NO INSTALAR. Esta es una extensión para probar la publicación de vscode...

muad-dib

Installation | Usage | Features | VS Code | CI/CD Version francaise Why MUAD'DIB? npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond. MUAD'DIB combines 22 parallel scanners 277 detection rules, a...

glassworm-hunter

glassworm-hunter Detecta cargas útiles de ataques a la cadena de suministro GlassWorm en tu máquina. Escanea extensiones de VS Code, paquetes npm, paquetes Python y repositorios git. Este escáner detecta la técnica de ataque en sí misma : cargas útiles invisibles de selectores de variación Unicod...

git-fsmonitor

这是一个已被记录（已知）的问题，但我在研究过程中发现了它，并且它对红队/渗透测试非常有用。 摘要： git 会在每次执行 git status、git diff 等命令时运行 FSMonitor 辅助程序，因此 git 会盲目地启动我们指定路径下的任何内容。我们的 IDE 在打开文件夹时会自动运行 git status 以填充其 SCM（源代码管理）面板； 这使得 git 能够生成配置好的辅助程序，从而执行攻击者控制的代码。这种技术可用于红队行动或假设已被攻破的场景中，配合任何 C2 或我们的 XRayC2 获取回调，从而绕过传统网络防御。（当然，需要发送钓鱼邮件来欺骗最终用户，但在 I...

code-wsl-rce

Prova de Conceito para Execução Remota de Código no VS Code Remote WSL - CVE-2021-43907 Veja o blog em https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-codes-remote-wsl-for-fun-and-negative-profit. Também https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43907. Compilação 1...

CVE-2021-26700

CVE-2021-26700 Примечание: данное руководство действительно только для участников лаборатории DSNS. Введение Это уязвимость удаленного выполнения кода RCE, которая находилась в расширении Visual Studio Code VS Code под названием npm, разработанном Microsoft и предназначенном для поддержки...

idacode

IDACode IDACode semplifica l'esecuzione e il debug di script Python nel tuo ambiente IDA senza lasciare Visual Studio Code. L'estensione VS Code è disponibile sul marketplace. IDACode è ancora in una fase molto preliminare e sono previsti bug. Per favore apri una nuova issue se incontri problemi...

PoC-CVE-2025-62222

PoC: CVE-2025-62222 - GitHub Copilot Chat RCE Este repositório contém uma Prova de Conceito PoC para a vulnerabilidade CVE-2025-62222. Demonstra como é possível alcançar a Execução Remota de Código RCE na máquina de um desenvolvedor manipulando o contexto do GitHub Copilot Chat no VS Code por mei...

maldev-for-dummies

Malware Development for Dummies In the age of EDR, red team operators cannot get away with using pre-compiled payloads anymore. As such, malware development is becoming a vital skill for any operator. Getting started with maldev may seem daunting, but is actually very easy. This workshop will sho...

idacode

IDACode IDACode makes it easy to execute and debug Python scripts in your IDA environment without leaving Visual Studio Code. The VS Code extension can be found on the marketplace. IDACode is still in a very early state and bugs are to be expected. Please open a new issue if you encounter any...

CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

PT-2026-77317

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom components/blueprint studio/backend/terminal manager.py accepted a cwd working-directory parameter and checked only whether the...

CVE-2026-19884

The CVE affects Eclipse Theia up to v1.69.0, where opening a folder can trigger source control integration and run git commands (e.g., git status) without user trust. A repository-local .git/config containing core.fsmonitor or similar settings can cause arbitrary commands to execute with the user...

CVE-2026-70335

The CVE-2026-70335 entry concerns an os command injection in GitHub Copilot and Visual Studio Code due to improper neutralization of special elements. This allows a local attacker to achieve elevation of privileges. The public records identify affected products (GitHub Copilot and VS Code) and de...

EUVD-2026-56437

No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-59113

CVE-2026-59113 concerns Visual Studio Code. The vulnerability is described as missing authorization that allows an unauthorized attacker to execute code over a network. The NVD entry cites a CVSS v3.1 base score of 8.8 (High) with network attack vector, no privileges required, user interaction re...