CVE-2021-21415

Katalog CVE

CVSS 7.8 · High EPSS 2,1%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada prisma language-tools. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Prisma VS Code a VSCode extension for Prisma schema files. This is a Remote Code Execution Vulnerability that affects all versions of the Prisma VS Code extension older than 2.20.0. If a custom binary path for the Prisma format binary is set in VS Code Settings, for example by downloading a project that has a .vscode/settings.json file that sets a value for "prismaFmtBinPath". That custom binary is executed when auto-formatting is triggered by VS Code or when validation checks are triggered after each keypress on a *.prisma file. Fixed in versions 2.20.0 and 20.0.27. As a workaround users can either edit or delete the `.vscode/settings.json` file or check if the binary is malicious and delete it.

Rincian

Terbit di NVD

29 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/prisma/language-tools/pull/750 patch · advisory pihak ketiga
• https://github.com/prisma/language-tools/security/advisories/GHSA-4rf9-43m7-x828 advisory pihak ketiga
• https://marketplace.visualstudio.com/items?itemName=Prisma.prisma product
• https://marketplace.visualstudio.com/items?itemName=Prisma.prisma-insider product