Executive brief
The WSO2 Integrator MI extension for VS Code contains a command injection vulnerability that allows arbitrary operating system commands to be executed when processing malicious Micro Integrator projects. An attacker can craft a malicious project that, when opened and trusted by a developer, executes arbitrary commands with the privileges of the user running VS Code, potentially compromising the developer's system and any work they perform.
Technical details
This is an OS command injection vulnerability in the WSO2 Integrator MI VS Code extension's unit test execution flow. The extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator project files from untrusted sources. The vulnerability is triggered when a user grants workspace trust to a malicious project and then executes unit tests, allowing injection of arbitrary OS commands. The attack requires user interaction (workspace trust grant and unit test trigger) but executes with the privileges of the user running VS Code. The fix is available in WSO2 Integrator: MI for Visual Studio Code v4.1.4 and above.
Affected products
- WSO2 Integrator MI for Visual Studio Code 4.1.3 and below
Timeline
- 2026-09-15: disclosed
- 2026-09-15: advisory: WSO2-2026-5854