CVE-2021-28956

Опубликовано: 22 мар. 2021

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

The unofficial vscode-sass-lint (aka Sass Lint) extension through 1.0.7 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Ссылки

https://github.com/glen-84/vscode-sass-lint/compare/v1.0.6...v1.0.7
Patch
Release Notes
Third Party Advisory
https://github.com/glen-84/vscode-sass-lint/releases
Release Notes
Third Party Advisory
https://marketplace.visualstudio.com/items/glen-84.sass-lint/changelog
Release Notes
Vendor Advisory
https://vuln.ryotak.me/advisories/1
Third Party Advisory
https://github.com/glen-84/vscode-sass-lint/compare/v1.0.6...v1.0.7
Patch
Release Notes
Third Party Advisory
https://github.com/glen-84/vscode-sass-lint/releases
Release Notes
Third Party Advisory
https://marketplace.visualstudio.com/items/glen-84.sass-lint/changelog
Release Notes
Vendor Advisory
https://vuln.ryotak.me/advisories/1
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sass_lint_project:sass_lint:*:*:*:*:*:visual_studio_code:*:*

Версия до 1.0.7 (включая)

EPSS

Процентиль: 66%

0.00512

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-28fc-gvjg-5f4h