CVE-2021-30124: Insufficient Information (NVD-CWE-noinfo)
value: The unofficial vscode-phpmd (aka PHP Mess Detector) extension before 1.3.0 for Visual Studio Code allows remote attackers to execute arbitrary code via a crafted phpmd.command value in a workspace folder.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2021-07-30T14:15Z
Repository: https://github.com/sandhje/vscode-phpmd
Language: JSON
Files changed: README.md, package.json
Commit date: 2021-04-06 23:18:49 +0200
Commit message: Fix remote code execution  

See CVE ID CVE-2021-30124
Diff: diff --git a/README.md b/README.md
index 6589041..bcfd322 100644
--- a/README.md
+++ b/README.md
@@ -38,10 +38,11 @@ To use PHPMD installed globally with composer on a windows machine set this sett
 
 Or to use your own PHPMD PHAR on a custom location: 
 ```
 "phpmd.command": "php C:/path/to/phpmd.phar"`
 ```
+***Security fix in version 1.3.0:*** *Before version 1.3.0 it was possible to set `phpmd.command` through workspace settings. This unfortunately opened possibilities for a remote code execution attack. Although I recognize that some users used this workspace setting in their day to day work I feel it is more important that anyone can use this extension without worrying about their system's security. As such, since version 1.3.0, this setting is disabled at workspace level to address this issue.* 
 
 ### phpmd.rules: 
 
 Customize the PHPMD ruleset files used. This option can also take the path to a custom [PHPMD ruleset file](https://phpmd.org/documentation/creating-a-ruleset.html). Use VS Code's workspace settings to control the rules or ruleset files per workspace. When setting a path to a ruleset file, and the path starts with "~/" this will be replaced with the OS homedir. The string "${workspaceFolder}" in a path to a ruleset file will be replaced with an absolute path to the folder in the workspace which relates to the file that is being validated. Refer to [PHPMD's documentation](https://phpmd.org/documentation/index.html) for more information on the ruleset parameter.
 
@@ -110,5 +111,6 @@ See client/CHANGELOG.md
 
 * The people behind [PHPMD](https://phpmd.org/people-behind.html)
 * The Microsoft VSCode team for [VSCode](https://code.visualstudio.com/) and [vscode-languageserver-node](https://github.com/Microsoft/vscode-languageserver-node).
 * Quentin Dreyer for his OS homedir replacement solution (https://github.com/qkdreyer)
 * Shane Smith for his spelling fixes (https://github.com/shane-smith)
+* Ryotek for reporting the phpmd.command security issue (https://twitter.com/ryotkak)
\ No newline at end of file
diff --git a/package.json b/package.json
index a309852..099d4fb 100644
--- a/package.json
+++ b/package.json
@@ -42,10 +42,11 @@
           "default": true,
           "description": "Enable mess detector"
         },
         "phpmd.command": {
           "type": "string",
+          "scope": "machine",
           "default": "",
           "description": "The phpmd command. Leave empty to use the shipped phpmd phar (local php executable is required)"
         },
         "phpmd.rules": {
           "type": "string",

Fixed code: ***Security fix in version 1.3.0:*** *Before version 1.3.0 it was possible to set `phpmd.command` through workspace settings. This unfortunately opened possibilities for a remote code execution attack. Although I recognize that some users used this workspace setting in their day to day work I feel it is more important that anyone can use this extension without worrying about their system's security. As such, since version 1.3.0, this setting is disabled at workspace level to address this issue.* 
* Ryotek for reporting the phpmd.command security issue (https://twitter.com/ryotkak)
          "scope": "machine",