Description
The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users using the VSCode extension to manage clusters that are shared amongst other users are affected by this issue. The only safe mitigation is to update to the latest version of the extension.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_confirm
https://github.com/weaveworks/vscode-gitops-tools/security/advisories/GHSA-873x-829r-gxcp
Scores
CVSS v3
9.0
EPSS
0.0110
EPSS Percentile
61.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (1)
weave/gitops_tools
0.7.0 - 0.20.2
Published
Aug 18, 2022
Tracked Since
Feb 18, 2026