CVE-2024-9145: Local command injection in Wiz Code Visual Studio Code extension
Wiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerable to local command injection if the user opens a maliciously crafted Dockerfile located in a path that has been marked as a "trusted folder" within Visual Studio Code, and initiates a manual scan of the file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9145?
CVE-2024-9145 is classified as a high severity vulnerability due to its potential for local command injection.
How do I fix CVE-2024-9145?
To fix CVE-2024-9145, update the Wiz Code Visual Studio Code extension to version 1.5.4 or later and the Wiz (legacy) extension to version 0.17.9 or later.
Which versions are affected by CVE-2024-9145?
CVE-2024-9145 affects Wiz Code Visual Studio Code extension versions 1.0.0 to 1.5.3 and Wiz (legacy) extension versions 0.13.0 to 0.17.8.
What types of attacks are possible with CVE-2024-9145?
CVE-2024-9145 allows for local command injection attacks when a user opens a specially crafted Dockerfile.
Who is the vendor of CVE-2024-9145?
The vendor of the affected products in CVE-2024-9145 is Wiz.