CVE-2026-19515: OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution
The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow.
Successful exploitation of this vulnerability could lead to the execution of arbitrary OS commands on the system where the VS Code extension is running. The extent of the impact is dependent on the privileges of the user account under which VS Code is operating. Exploitation requires the user to grant workspace trust to the malicious project and subsequently trigger the unit test execution.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the WSO2 Integrator MI VS Code extension who open Micro Integrator projects from untrusted sources are exposed if they grant workspace trust and run the project's unit tests. The commands execute with the privileges of the account running VS Code.
What interaction is required for exploitation?
An attacker needs to provide a crafted Micro Integrator project. The user must grant workspace trust to that project and then trigger unit test execution; opening the project alone is not described as sufficient.
What can be done if patching is not immediately possible?
Do not grant workspace trust to untrusted Micro Integrator projects, and do not run unit tests from projects whose source or contents have not been verified. Use a lower-privileged account for VS Code where possible to reduce the impact of command execution.