Vulnerability · Published Apr 1, 2021 · Assigned by GitHub_M

CVE-2021-21420Vulnerability in Stripe for Visual Studio Code < 1.7.3

High 7.5

In plain English

A high-severity injection in vscode-stripe from stripe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 51.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

vscode-stripe is an extension for Visual Studio Code. A vulnerability in Stripe for Visual Studio Code extension exists when it loads an untrusted source-code repository containing malicious settings. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. The update addresses the vulnerability by modifying the way the extension validates its settings.

Affected products (as reported)

Vendor	Product	Versions
stripe	vscode-stripe	< 1.7.3

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/stripe/vscode-stripe/security/advisories/GHSA-j6x4-4622-8vv3 x_refsource_CONFIRM