CVE-2024-9145
Local command injection in Wiz Code Visual Studio Code extension
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Local command injection in Wiz Code Visual Studio Code extension
Wiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerable to local command injection if the user opens a maliciously crafted Dockerfile located in a path that has been marked as a "trusted folder" within Visual Studio Code, and initiates a manual scan of the file.
Reserved 2024-09-24 | Published 2024-10-01 | Updated 2024-11-21 | Assigner WizRohit Kumar
www.wiz.io/security-advisories
marketplace.visualstudio.com/items/WizCloud.wizcli-vscode/changelog
marketplace.visualstudio.com/items/WizCloud.wiz-vscode/changelog
Support options
