Arch Linux Security Advisory ASA-202107-34
=========================================
Severity: Medium
Date    : 2021-07-20
CVE-ID  : CVE-2021-31211 CVE-2021-31214
Package : code
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1963

Summary
======
The package code before version 1.58.0-1 is vulnerable to arbitrary
code execution.

Resolution
=========
Upgrade to 1.58.0-1.

# pacman -Syu "code>=1.58.0-1"

The problems have been fixed upstream in version 1.58.0.

Workaround
=========
None.

Description
==========
- CVE-2021-31211 (arbitrary code execution)

An arbitrary code execution vulnerability through crafted remote
terminal settings has been found in Visual Studio Code before version
1.57.0.

- CVE-2021-31214 (arbitrary code execution)

An arbitrary code execution vulnerability in the Grunt, Gulp and Jake
task auto detection has been found in Visual Studio Code before version
1.57.0.

Impact
=====
An attacker could execute arbitrary code through crafted remote
terminal settings or JavaScript task runner configuration files without
user interaction.

References
=========
https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31211
https://github.com/microsoft/vscode/issues/123590
https://github.com/microsoft/vscode/commit/7259955ce318a2bb2a86ee121c34dcaab0a86e45
https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31214
https://github.com/microsoft/vscode/issues/123588
https://github.com/microsoft/vscode/commit/5f3466a21e80b2c016a1c0cbe2af683c9072d0a7
https://security.archlinux.org/CVE-2021-31211
https://security.archlinux.org/CVE-2021-31214