CVE-2021-29261 (published 2021-04-05T07:15Z)

The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace configuration.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/sveltejs/language-tools
commit_details: repo_url: https://github.com/sveltejs/language-tools
author: Simon H
author_date: 2021-03-23 09:25:29+01:00
msg: (fix) make runtime/ls-path configurable in user settings only

Due to security reasons: If this could be set in the workspace, a malicious workspace could point this to an arbitrary executable.
repository: repo_url: https://github.com/sveltejs/language-tools
repo_name: sveltejs/language-tools
description: The Svelte Language Server, and official extensions which use it
repo_language: TypeScript
owner: sveltejs
file_changes: filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -49,14 +49,16 @@
             "title": "Svelte",
             "properties": {
                 "svelte.language-server.runtime": {
+                    "scope": "application",
                     "type": "string",
                     "title": "Language Server Runtime",
-                    "description": "- You normally don't need this - Path to the node executable to use to spawn the language server. This is useful when you depend on native modules such as node-sass as without this they will run in the context of vscode, meaning node version mismatch is likely."
+                    "description": "- You normally don't need this - Path to the node executable to use to spawn the language server. This is useful when you depend on native modules such as node-sass as without this they will run in the context of vscode, meaning node version mismatch is likely. This setting can only be changed in user settings for security reasons."
                 },
                 "svelte.language-server.ls-path": {
+                    "scope": "application",
                     "type": "string",
                     "title": "Language Server Path",
-                    "description": "- You normally don't set this - Path to the language server executable. If you installed the \"svelte-language-server\" npm package, it's within there at \"bin/server.js\". Path can be either relative to your workspace root or absolute. Set this only if you want to use a custom version of the language server."
+                    "description": "- You normally don't set this - Path to the language server executable. If you installed the \"svelte-language-server\" npm package, it's within there at \"bin/server.js\". Path can be either relative to your workspace root or absolute. Set this only if you want to use a custom version of the language server. This setting can only be changed in user settings for security reasons."
                 },
                 "svelte.language-server.port": {
                     "type": "number",

programming_language: CoffeeScript