CVE-2021-30502

moderate-risk
Published 2021-04-25

The unofficial vscode-ghc-simple (aka Simple Glasgow Haskell Compiler) extension before 0.2.3 for Visual Studio Code allows remote code execution via a crafted workspace configuration with replCommand.

Do I need to act?

~
4.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: b883e7ba59a3daf3db22c58d8a85dd0648a4dc74, bc7f6f0b857dade46ea51496d8bd1a4edef39b46
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Simple Glasgow Haskell Compiler

Affected Vendors

Simple Glasgow Haskell Compiler Project

References (8)

Release Notes https://github.com/dramforever/vscode-ghc-simple/blob/master/CHANGELOG.md#v023
Patch https://github.com/dramforever/vscode-ghc-simple/commit/bc7f6f0b857dade46ea51496...
Release Notes https://github.com/dramforever/vscode-ghc-simple/releases
Third Party Advisory https://vuln.ryotak.me/advisories/38
Release Notes https://github.com/dramforever/vscode-ghc-simple/blob/master/CHANGELOG.md#v023
Patch https://github.com/dramforever/vscode-ghc-simple/commit/bc7f6f0b857dade46ea51496...
Release Notes https://github.com/dramforever/vscode-ghc-simple/releases
Third Party Advisory https://vuln.ryotak.me/advisories/38
44
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 7/34 · Low
Exposure 5/34 · Minimal