Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2021-26700 — Proof-of-concept for CVE-2021-26700: remote code execution in the VSCode npm-script extension via malicious workspace settings.json, with detailed exploitation and remediation guidance. | Kitploit
Tools/GitHubGitHub/jackadamson/cve-2021-26700
Vulnerability AnalysisCode AnalysisExploitationWeb Application ExploitationSupply Chain SecurityLearning & Education
GitHubjackadamson/cve-2021-26700

CVE-2021-26700

Proof-of-concept for CVE-2021-26700: remote code execution in the VSCode npm-script extension via malicious workspace settings.json, with detailed exploitation and remediation guidance.

View Repository
20165 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

RCE in NPM VSCode Extension

Fixed 10th February 2021 in https://github.com/microsoft/vscode-npm-scripts/commit/cdd5e507564e0cc0f60bcccf184822be3fd73e07

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26700

Summary

Remote code execution vulnerability in the eg2.vscode-npm-script (Tested on version 0.3.13) VSCode extension means that a malicious .vscode/settings.json in a project can cause remote code execution when a file named package.json is viewed.

This vulnerability did not fall under any active Microsoft bug bounty program, but was reported to and handled by MSRC.

Description

Without a malicious .vscode/settings.json file in a repository, upon viewing a package.json file, with the eg2.vscode-npm-script extension installed, the command will be executed.

npm ls --depth 0 --json

By setting the npm.bin key in a projects settings.json eg. to ./payload.sh, viewing the package.json will instead execute ./payload.sh ls --depth 0 --json from the directory containing the package.json.

This vulnerability breaks the assumption that source-code can be safely read.

Example Attack

An example of how this could be used by an attacker is:

  1. Attacker publishes repository such as attached linux-poc
  2. Target clones repository to read the source code in VSCode
  3. Target views package.json
  4. payload.sh is executed

Remediation Options

I've seen two ways of mitigating malicious VSCode Workspace settings.json

Mitigation 1 - User Only Settings

Forbid the settings to be set per workspace. This is already used by VSCode for git.path, terminal.integrated.shell.linux and a few other settings.

This could break compatibility for some users, but has precedent.
Reference: https://vscode.readthedocs.io/en/latest/getstarted/settings/#settings-and-security

Mitigation 2 - Prompt for Confirmation

If this setting is set in a workspace, prompt the user to confirm the setting before executing the binary.
This will not break existing compatibility, and is the route taken by the ESLint Extension as of version 2.1.7.

Proof of Concept

Linux

  1. Install vulnerable version (0.3.13 or earlier) of VSCode extension eg2.vscode-npm-script
  2. Open linux-poc directory as a folder in VSCode
  3. In VSCode click the package.json file to view it
  4. The file /tmp/output.txt will be created to demonstrate execution

Windows

  1. Install vulnerable version (0.3.13 or earlier) of VSCode extension eg2.vscode-npm-script
  2. Open windows-poc directory as a folder in VSCode
  3. In VSCode click the package.json file to view it
  4. calc.exe will be opened

Note: I was unable to use a relative path for the binary in Windows, however this may be due to my lack of familiarity with Windows

Download Tool