CVE-2021-22539

An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recommend upgrading to version 0.4.1 or above.

• CWE-73
• CWE-668

• https://github.com/bazelbuild/vscode-bazel-ghsa-2rcw-j8x4-hgcv/pull/1Broken Link
• https://github.com/bazelbuild/vscode-bazel/security/advisories/GHSA-2rcw-j8x4-hgcvThird Party Advisory
• https://github.com/bazelbuild/vscode-bazel-ghsa-2rcw-j8x4-hgcv/pull/1Broken Link
• https://github.com/bazelbuild/vscode-bazel/security/advisories/GHSA-2rcw-j8x4-hgcvThird Party Advisory

Published

Apr 16, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22530A vulnerability identified in NetIQ Advance Authentication t…9.9
• CVE-2021-22531A bug exist in the input parameter of Access Manager that al…6.1
• CVE-2021-22532Possible NLDAP Denial of Service attack Vulnerability in eD…7.5
• CVE-2021-22533Possible Insertion of Sensitive Information into Log File Vu…9.1
• CVE-2021-22535Unauthorized information security disclosure vulnerability o…4.9
• CVE-2021-22538A privilege escalation vulnerability impacting the Google Ex…8.8
• CVE-2021-2254Vulnerability in the Oracle Project Contracts product of Ora…8.1
• CVE-2021-22540Bad validation logic in the Dart SDK versions prior to 2.12.…6.1
• CVE-2021-22543An issue was discovered in Linux: KVM through Improper handl…7.8
• CVE-2021-22545An attacker can craft a specific IdaPro *.i64 file that will…7.8
• CVE-2021-22547In IoT Devices SDK, there is an implementation of calloc() t…7.8
• CVE-2021-22548An attacker can change the pointer to untrusted memory to po…7.8