Executive brief
The vscode-npm-script Visual Studio Code extension allows developers to run npm scripts directly from the editor interface. A remote code execution vulnerability in this extension enables attackers to execute arbitrary code on a developer's machine when the extension processes malicious npm package configurations or scripts.
Technical details
The vscode-npm-script extension contains a remote code execution vulnerability (CVE-2021-26700) that allows arbitrary code execution in the context of the VS Code process. The vulnerability stems from insufficient validation or sanitization when processing npm scripts or package.json files. An attacker can exploit this by crafting a malicious npm package or project configuration that, when opened or processed by the extension, executes arbitrary code with the privileges of the user running VS Code. The extension has been archived and is no longer maintained by Microsoft, meaning no patches are available.
Affected products
- Microsoft vscode-npm-script all versions
Timeline
- 2021-02-25: disclosed
- 2022-05-24: advisory