David Dworken

Name of the Vulnerable Software and Affected Versions: Eclipse Theia versions 0.1.1 through 0.2.0 Description: The issue allows for remote code execution and XXE via the theia-xml-extension, which uses lsp4xml (recently renamed to LemMinX) for XML language support. This extension is installed by default. Recommendations: For Eclipse Theia versions 0.1.1 through 0.2.0, consider disabling the theia-xml-extension as a temporary workaround until a patch is available. Restrict access to the LemMinX component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Visual Studio Code (affected versions not specified) **Description** The issue is related to incorrect code generation management in the editor. Exploitation of this issue may allow an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** vscode-stripe (affected versions not specified) **Description** A vulnerability exists in the Stripe for Visual Studio Code extension when it loads an untrusted source-code repository containing malicious settings. This could allow an attacker to run arbitrary code in the context of the current user. The issue is related to the extension's validation of its settings. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Visual Studio Code Remote Development Extension (affected versions not specified) **Description** The issue is related to incorrect code generation management in the Remote Development Extension for Visual Studio Code. Exploitation of this issue may allow a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Visual Studio Code Java Extension Pack (affected versions not specified) **Description** The issue is related to incorrect code generation management in the Visual Studio Code Java Extension Pack. Exploitation of this issue may allow a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Visual Studio Code ESLint Extension (affected versions not specified) Description: The issue is related to a lack of protection for internal data in the Microsoft Visual Studio Code ESLint Extension. Exploitation of this issue may allow an attacker to execute arbitrary code. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Quantum Development Kit for Visual Studio Code (affected versions not specified) Description: The issue is related to a lack of protection for service data in the Microsoft Quantum Development Kit for Visual Studio Code. This can allow an attacker to execute arbitrary code. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Visual Studio (affected versions not specified) Visual Studio Code (affected versions not specified) **Description** The issue is related to insufficient input validation in Microsoft Visual Studio, which can allow an attacker to execute arbitrary code. This is a remote code execution vulnerability. **Recommendations** For Microsoft Visual Studio, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Visual Studio Code, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Visual Studio Code (affected versions not specified) **Description** A remote code execution issue exists when Visual Studio Code processes environment variables after opening a project. An attacker who successfully exploits this could run arbitrary code in the context of the current user. If the current user has administrative rights, the attacker could take control of the system, install programs, view, change, or delete data, or create new accounts with full user rights. To exploit this, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code, with attacker-specified code executing when the target opens the integrated terminal. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eclipse Web Tools Platform versions prior to 3.18 (2020-06) **Description** The issue allows XML and DTD files referring to external entities to be exploited, sending the contents of local files to a remote server when edited or validated. This can occur even when external entity resolution is disabled in the user preferences. **Recommendations** For Eclipse Web Tools Platform versions prior to 3.18 (2020-06), consider updating to a version newer than 3.18 (2020-06) to resolve the issue. As a temporary workaround, restrict the editing and validation of XML and DTD files that refer to external entities to minimize the risk of exploitation.