Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2021-28794: Visual Studio Code ShellCheck Extension Executes Malicious Shell
CVE-2021-28794 · published 5 years ago
Summary
The ShellCheck extension for Visual Studio Code allows an attacker to execute arbitrary code on your system if you use a malicious shell. This is a security risk if you're using the extension with a shell that you don't fully trust. Update to version 0.13.4 or later to fix this issue.
What to do
- Update shellcheck_project shellcheck to version 0.13.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| shellcheck_project | shellcheck |
< 0.13.4 cpe:2.3:a:shellcheck_project:shellcheck:*:*:*:*:*:visual_studio_code:*:* |
Original advisory text
The unofficial ShellCheck extension before 0.13.4 for Visual Studio Code mishandles shellcheck.executablePath.
The unofficial ShellCheck extension before 0.13.4 for Visual Studio Code mishandles shellcheck.executablePath.
References
- https://github.com/timonwong/vscode-shellcheck/pull/181 Patch Third Party Advisory
- https://github.com/timonwong/vscode-shellcheck/releases/tag/v0.13.4 Release Notes Third Party Advisory
- https://vuln.ryotak.me/advisories/10 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published18 Mar 2021
Updated3 Nov 2026
First seen9 Jul 2026
Track software like this
Free during beta