EUVD-2026-78364
GHSA-hrrx-73rq-wgm3
Severity by source
AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (WSO2) · only source for this CVE.
CVSS VectorVendor: WSO2
Lifecycle Timeline
2DescriptionCVE.org
The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow.
Successful exploitation of this vulnerability could lead to the execution of arbitrary OS commands on the system where the VS Code extension is running. The extent of the impact is dependent on the privileges of the user account under which VS Code is operating. Exploitation requires the user to grant workspace trust to the malicious project and subsequently trigger the unit test execution.
AnalysisAI
A command injection flaw in the WSO2 Integrator MI extension for Visual Studio Code lets a crafted Micro Integrator project run arbitrary operating system commands when its unit test execution flow is triggered. Exploitation is not remote or silent: the developer must open the untrusted project, explicitly grant it workspace trust, and then run the project's unit tests, after which injected commands execute with the privileges of the VS Code user (CVSS 3.1 base 7.0, AV:L/AC:H/PR:N/UI:R). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today