Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2024-9145

Local command injection in Wiz Code Visual Studio Code extension

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wiz

Description

Wiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerable to local command injection if the user opens a maliciously crafted Dockerfile located in a path that has been marked as a "trusted folder" within Visual Studio Code, and initiates a manual scan of the file.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Wiz Wiz Code Visual Studio Code extension

Default version status: unaffected

  • 1.0.0 to ≤ 1.5.3affected
  • 0.13.0 to ≤ 0.17.8affected

References