CVE-2021-29261

HIGH

Svelte < 104.8.0 - Remote Code Execution via Workspace Configuration

Title source: llm
STIX 2.1

Description

The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace configuration.

References (5)

Core 5
Core References
Product, Third Party Advisory x_refsource_misc
https://marketplace.visualstudio.com/items?itemName=svelte.svelte-vscode
Third Party Advisory x_refsource_misc
https://github.com/sveltejs/language-tools/releases
Third Party Advisory x_refsource_misc
https://vuln.ryotak.me/advisories/3
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/sveltejs/language-tools/releases/tag/extensions-104.8.0

Scores

CVSS v3 7.8
EPSS 0.0124
EPSS Percentile 65.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

Status published
Products (1)
svelte/svelte < 104.8.0
Published Apr 05, 2021
Tracked Since Feb 18, 2026