Arch Linux Security Advisory ASA-202107-34 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-31211 CVE-2021-31214 Package : code Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1963 Summary ======= The package code before version 1.58.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.58.0-1. # pacman -Syu "code>=1.58.0-1" The problems have been fixed upstream in version 1.58.0. Workaround ========== None. Description =========== - CVE-2021-31211 (arbitrary code execution) An arbitrary code execution vulnerability through crafted remote terminal settings has been found in Visual Studio Code before version 1.57.0. - CVE-2021-31214 (arbitrary code execution) An arbitrary code execution vulnerability in the Grunt, Gulp and Jake task auto detection has been found in Visual Studio Code before version 1.57.0. Impact ====== An attacker could execute arbitrary code through crafted remote terminal settings or JavaScript task runner configuration files without user interaction. References ========== https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-... https://github.com/microsoft/vscode/issues/123590 https://github.com/microsoft/vscode/commit/7259955ce318a2bb2a86ee121c34dcaab... https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-... https://github.com/microsoft/vscode/issues/123588 https://github.com/microsoft/vscode/commit/5f3466a21e80b2c016a1c0cbe2af683c9... https://security.archlinux.org/CVE-2021-31211 https://security.archlinux.org/CVE-2021-31214