Sy2N0

Missing authorization in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

A flaw in the Permission Model enforcement allows for the over-granting of filesystem access across radix-tree prefix boundaries. When the `--permission` flag is used, an attacker granted access to a specific path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. A radix-tree is a space-optimized trie data structure used for efficient searching of keys, in this case, filesystem paths.

An issue exists where `nvm ls-remote` and other commands that refresh remote LTS aliases, such as `nvm install --lts`, parse the node.js mirror's `index.tab` and use the LTS codename field as an alias filename without validation. A compromised mirror or a man-in-the-middle attack can return an LTS codename containing path-traversal sequences, such as `../../../.bashrc`. This allows the software to write version strings to paths outside the `$NVM DIR/alias` directory. In default configurations where `$NVM DIR` is `~/.nvm`, this can result in the creation or overwriting of files in the user's home directory, including shell startup files, potentially leading to code execution in subsequent shell sessions. Exploitation requires the use of a hostile mirror via a compromised CDN, network man-in-the-middle, or a malicious configuration of the `NVM NODEJS ORG MIRROR` or `NVM IOJS ORG MIRROR` variables.