Mykhailo Kholiev

**Name of the Vulnerable Software and Affected Versions** WSO2 Integrator MI VS Code extension (affected versions not specified) **Description** The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This flaw allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow. Successful exploitation leads to arbitrary OS command execution on the system running the extension, with the impact depending on the privileges of the user account operating VS Code. Exploitation requires the user to grant workspace trust to the malicious project and trigger the unit test execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.