Jiyong Yang

Missing authorization in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

The `ASGIRequest` component is susceptible to a denial-of-service condition. A remote attacker can exploit this by sending a specially crafted request containing duplicate headers.

A command injection issue exists in nvm (Node Version Manager). The `nvm download()` function utilizes `eval` to execute `wget` commands. The `NVM AUTH HEADER` environment variable was not properly sanitized when used in the `wget` code path. An attacker capable of setting environment variables within a victim’s shell environment—for example, through malicious CI/CD configurations, compromised dotfiles, or Docker images—can inject arbitrary shell commands. These commands will execute when the victim runs nvm commands that initiate downloads, such as 'nvm install' or 'nvm ls-remote'.