CVE-2025-3804 thautwarm vscode-diana Jinja2 Template Gen.py injection

A vulnerability classified as critical has been found in thautwarm vscode-diana 0.0.1. Affected is an unknown function of the file Gen.py of the component Jinja2 Template Handler. The manipulation leads to injection. Attacking locally is a requirement. The exploit has been disclosed to the public...

PT-2025-17381 · Jinja2 +1 · Jinja2 +2

Name of the Vulnerable Software and Affected Versions: thautwarm vscode-diana version 0.0.1 Description: A critical vulnerability has been found in the Jinja2 Template Handler component of thautwarm vscode-diana. The issue affects an unknown function of the file Gen.py and leads to injection. Loc...

VSCode Marketplace Removes Two Extensions Deploying Early-Stage Ransomware

Cybersecurity researchers have uncovered two malicious extensions in the Visual Studio Code VSCode Marketplace that are designed to deploy ransomware that's under development to its users. The extensions, named "ahban.shiba" and "ahban.cychelloworld," have since been taken down by the marketplace...

Malicious code in vscode-typescript-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9162b86c7482b306e1b5ef08b17ce67a14c45fbb9ae585e6113b17174fb27409 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2584 Malicious code in vscode-typescript-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9162b86c7482b306e1b5ef08b17ce67a14c45fbb9ae585e6113b17174fb27409 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vscode-ps1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89a6b0c5359c6999b0721fc722f11353dd05b6e52a6795c5da8174e0a353fa54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Hemi VDP: VSCode launch.json file exposed on hemi.xyz

A .vscode/launch.json file was published publicly on https://hemi.xyz/...

FreeBSD : vscode -- multiple vulnerabilities (cbf5d976-656b-4bb6-805f-3af038e2de3e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the cbf5d976-656b-4bb6-805f-3af038e2de3e advisory. VSCode developers report: The update addresses these issues, including a fix for a security...

vscode -- multiple vulnerabilities

VSCode developers report: The update addresses these issues, including a fix for a security vulnerability. Scope nodemodule binary resolution in js-debug Elevation of Privilege Vulnerability with VS Code server for web UI...

CVE-2024-10383 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab VSCode Fork

An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343and used by all versions of GitLab CE/EE starting from 15.11 prior to 17.3 and which also temporarily affected versions 17.4, 17.5 and 17.6,...

Malicious code in llvm-vs-code-extensions.vscode-clangd (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b822fb613c3a0252eacdb48a5dea6a7b94786cc7b461e72423800257d6d650c Any computer that has this package installed or running should be considered...

Malicious code in hakana-vscode-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4283dda977b9f5905c6752d3d3f8b09b8a15f375ee7d903bb800e86d10e2db11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1129 Malicious code in hakana-vscode-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4283dda977b9f5905c6752d3d3f8b09b8a15f375ee7d903bb800e86d10e2db11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in theme-check-vscode (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in vscode-bazel-bsp (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-696 Malicious code in vscode-bazel-bsp (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-690 Malicious code in theme-check-vscode (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-342 Malicious code in op-vscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc75870385e27f624816db6a388a5a188640a523bb7d967dbb848ac33dda21b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in op-vscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc75870385e27f624816db6a388a5a188640a523bb7d967dbb848ac33dda21b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vscode-tcf-debug (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 081bab0ec2ee34f3590622d06dc898c469bd03a5919b3f05c6637e0744439f59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...