live-server-evil-crawler

Live Server 邪恶爬虫 一个 GitHub Pages 站点，用于演示 Live Server VSCode 扩展漏洞（CVE-2025-65717）。 概述 该工具演示了一个漏洞：Live Server 允许来自任何来源的请求，从而使得恶意网页能够访问运行在 localhost 上的 Live Server 并读取文件系统内容。 功能 端口扫描器 ：扫描一定范围的端口以检测正在运行的 Live Server 实例 爬虫 ：递归探索检测到的服务器的目录结构 基于 该代码基于以下文章： Ox Security - CVE-2025-65717: Live Server VSCod...

CVE-2021-26700

NPM VSCode 확장 프로그램의 RCE 2021년 2월 10일 수정됨 https://github.com/microsoft/vscode-npm-scripts/commit/cdd5e507564e0cc0f60bcccf184822be3fd73e07 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26700 요약 eg2.vscode-npm-script 버전 0.3.13에서 테스트됨 VSCode 확장 프로그램의 원격 코드 실행 취약점은 프로젝트 내 악성...

vscode-github-token-grab-extension

hello-world 自述文件 请勿安装。这是一个用于我测试 VS Code 发布的扩展。...

vscode-frida

VSCode用Fridaワークベンチ リポジトリ | Issues | インストール これはコミュニティ貢献プロジェクトであり、公式のFridaチームとは関係ありません。Fridaスクリプティング体験を向上させるためのVisual Studio Code用オープンソース拡張機能として、@CodeColoristによって開発・保守されています。 中文说明 前提条件 Python = 3.7 frida-tools Pythonパッケージ オプションの依存関係 libimobiledevice inetcatコマンドでSSHシェルを起動するため Windows版iTunes iOSのUSB接...

CVE-2026-70336 Visual Studio Code Remote Code Execution Vulnerability

...

MAL-2026-11558 Malicious code in @cacheable/memory (npm)

npm/@cacheable/memory version 2.2.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

EUVD-2026-50979

The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentia...

CVE-2026-47858 live information startup mode is vulnerable for remote code execution

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Thei...

CVE-2026-47858

CVE-2026-47858 affects Spring Tools environments when the live information startup mode is enabled in Spring Tools for Eclipse (5.2.0 and earlier) and Spring Tools for VSCode/Cursor/Theia (2.2.0 and earlier). The vulnerability is described as a JMX-based remote code execution risk arising from th...

PT-2026-66364

Name of the Vulnerable Software and Affected Versions Spring Tools for Eclipse versions prior to 5.2.1 Spring Tools for VSCode / Cursor / Theia versions prior to 2.2.1 Description Starting Spring Boot applications in Spring Tools with the live information mode enabled allows for remote code...

CVE-2026-46412 Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

CVE-2026-59831

GitHub CLI gh is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopbac...

MAL-2026-7432 Malicious code in vscode-component-explorer (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2026-12856

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

CVE-2026-12856

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

CVE-2026-12856 Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

CVE-2026-12856 Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

CVE-2026-12856

The CVE-2026-12856 entry concerns the vscode-java extension for Visual Studio Code. The vulnerability arises because the extension trusts all Markdown content in JavaDoc hovers, enabling a malicious Java file to include hidden commands. When a user clicks a specially crafted link in a JavaDoc hov...

CVE-2026-12856

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

MAL-2026-6361 Malicious code in vscode-test-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c62d19484eeb938a92dfdcc6cbce9dba47e390676774254b0dc318702a214418 Package occupies the unscoped npm name vscode-test-web, a likely-misreference target for the legitimate @vscode/test-web scoped package. On require,...