CVE-2022-35976

    Dashboard / Vulnerabilities / CVE-2022-35976

    CVE-2022-35976

    Published: 18 Aug 2022Last Modified: 12 Aug 2026

    Summary: Improper KubeConfig handling allows arbitrary code execution

    Details: The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary code execution on behalf of the user running VSCode. Users relying on kubeconfigs that are generated or altered by other processes or users are affected by this issue. Please note that the vulnerability is specific to this extension, and the same kubeconfig would not result in arbitrary code execution when used with kubectl. Using only trust-worthy kubeconfigs is a safe mitigation. However, updating to the latest version of the extension is still highly recommended.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35976.json, https://github.com/weaveworks/vscode-gitops-tools/security/advisories/GHSA-287h-vjhw-jqf7, https://nvd.nist.gov/vuln/detail/CVE-2022-35976

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 874053b095d7f5568d77b4f688147dac26773f76
    Fixed -None

    Affected versions

    v0.20.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-35976 | CVE-DB