Exploitation Summary
EIP tracks 3 public exploits for CVE-2021-26700. PoCs published by jackadamson, jadamson08, june-in-exile.
AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2021-26700, demonstrating remote code execution in the VSCode NPM extension by manipulating the `npm.bin` setting in `.vscode/settings.json` to execute arbitrary scripts when viewing a `package.json` file.
Description
Visual Studio Code npm-script Extension Remote Code Execution Vulnerability
Exploits (3)
This repository contains a functional proof-of-concept exploit for CVE-2021-26700, demonstrating remote code execution in the VSCode NPM extension by manipulating the `npm.bin` setting in `.vscode/settings.json` to execute arbitrary scripts when viewing a `package.json` file.
This repository contains a functional proof-of-concept exploit for CVE-2021-26700, demonstrating remote code execution in the VSCode extension 'eg2.vscode-npm-script' by manipulating the 'npm.bin' setting in a malicious '.vscode/settings.json' file.
This repository contains a functional exploit for CVE-2021-26700, a remote code execution vulnerability in the npm extension for Visual Studio Code. The exploit leverages a malicious script hidden in a GitHub repository that executes when a victim opens a crafted package.json file in VS Code with the vulnerable extension installed.
References (1)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H