CVE-2021-22539: google bazel

csirt@kutim:~/threat-intel/cve/CVE-2021-22539

CVSS 7.8 · High EPSS 0,31%

Kerentanan External Control of File Name or Path pada google bazel. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recommend upgrading to version 0.4.1 or above.

Rincian

Terbit di NVD: 16 April 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-73: External Control of File Name or Path
CWE-668: Exposure of Resource to Wrong Sphere
EPSS (30 hari): 0,31% peluang dieksploitasi; lebih tinggi dari 22,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
google	bazel	Versi 0.1.0 hingga sebelum 0.4.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/bazelbuild/vscode-bazel/security/advisories/GHSA-2rcw-j8x4-hgcv advisory pihak ketiga
https://github.com/bazelbuild/vscode-bazel-ghsa-2rcw-j8x4-hgcv/pull/1 broken link

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.