MEDIUM child-process-exec Extension spawns subprocesses via child_process
examples/vulnerable-demo.js :66
`{file_path}` imports child_process and calls exec / spawn / execFile / fork. Subprocess execution lets the extension pivot from the VSCode host into the user's shell.
// ❌ LLM02: Executing LLM Output
async function runAICode(response) {
const code = response.choices[0].message.content;
eval(code); // Critical: Executing untrusted LLM output
}
// ❌ CISA: Command Injection
const { exec } = require('child_process');
function runCommand(userCommand) {
▶ exec(userCommand); // Critical: Command injection
}
Affected versions
marketplace 0.2.0