Svelte for VS Code
svelte.svelte-vscode
· published by svelte
verified
CRITICAL
9 findings detected for svelte.svelte-vscode — 2 critical, 2 high, 5 medium.
2 CRITICAL2 HIGH5 MEDIUM
2026-05-26 18:55 UTC
last scanned
Source coverage
- open-vsx v110.0.0 verified
- marketplace v110.0.0 verified
Findings
CRITICAL windows-script-host Windows Script Host invocation
node_modules/svelte/compiler.cjs :40490
`{file_path}` references cscript / wscript or the `//e:jscript` switch. WSH runs scripts outside the V8 sandbox with full Win32 and WMI access.
'Uint8ClampedArray',
'VBArray',
'VTTCue',
'VTTRegion',
'ValidityState',
'VarDate',
'VideoColorSpace',
'VideoPlaybackQuality',
'VisualViewport',
'WSH',
▶ 'WScript',
'WaveShaperNode',
'WeakMap',
'WeakRef',
'WeakSet',
'WebAssembly',
'WebGL2RenderingContext',
'WebGLActiveInfo',
'WebGLBuffer',
'WebGLContextEvent',
'WebGLFramebuffer',
Affected versions
marketplace 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.4, 109.6.0, 109.9.0, 110.0.0
open-vsx 109.10.0, 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.2, 109.7.0, 110.0.0
CRITICAL windows-script-host Windows Script Host invocation
node_modules/svelte/src/compiler/utils/globals.js :579
`{file_path}` references cscript / wscript or the `//e:jscript` switch. WSH runs scripts outside the V8 sandbox with full Win32 and WMI access.
'Uint8ClampedArray',
'VBArray',
'VTTCue',
'VTTRegion',
'ValidityState',
'VarDate',
'VideoColorSpace',
'VideoPlaybackQuality',
'VisualViewport',
'WSH',
▶ 'WScript',
'WaveShaperNode',
'WeakMap',
'WeakRef',
'WeakSet',
'WebAssembly',
'WebGL2RenderingContext',
'WebGLActiveInfo',
'WebGLBuffer',
'WebGLContextEvent',
'WebGLFramebuffer',
Affected versions
marketplace 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.4, 109.6.0, 109.9.0, 110.0.0
open-vsx 109.10.0, 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.2, 109.7.0, 110.0.0
HIGH env-mass-collection Bulk read of process.env
node_modules/vscode-languageclient/lib/node/main.js :194
`{file_path}` enumerates the entire process.env object rather than reading a specific variable. Common precursor to exfiltrating GITHUB_TOKEN, AWS_*, and similar credentials.
if (params.processId === null) {
params.processId = process.pid;
}
}
createMessageTransports(encoding) {
function getEnvironment(env, fork) {
if (!env && !fork) {
return undefined;
}
const result = Object.create(null);
▶ Object.keys(process.env).forEach(key => result[key] = process.env[key]);
if (fork) {
result['ELECTRON_RUN_AS_NODE'] = '1';
result['ELECTRON_NO_ASAR'] = '1';
}
if (env) {
Object.keys(env).forEach(key => result[key] = env[key]);
}
return result;
}
const debugStartWith = ['--debug=', '--debug-brk=', '--inspect=', '--inspect-brk='];
Affected versions
marketplace 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.4, 109.6.0, 109.9.0, 110.0.0
open-vsx 109.10.0, 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.2, 109.7.0, 110.0.0
HIGH env-mass-collection Bulk read of process.env
node_modules/vscode-languageserver/lib/node/files.js :121
`{file_path}` enumerates the entire process.env object rather than reading a specific variable. Common precursor to exfiltrating GITHUB_TOKEN, AWS_*, and similar credentials.
exports.resolve = resolve;
/**
* Resolve the global npm package path.
* @deprecated Since this depends on the used package manager and their version the best is that servers
* implement this themselves since they know best what kind of package managers to support.
* @param tracer the tracer to use
*/
function resolveGlobalNodePath(tracer) {
let npmCommand = 'npm';
const env = Object.create(null);
▶ Object.keys(process.env).forEach(key => env[key] = process.env[key]);
env['NO_UPDATE_NOTIFIER'] = 'true';
const options = {
encoding: 'utf8',
env
};
if (isWindows()) {
npmCommand = 'npm.cmd';
options.shell = true;
}
let handler = () => { };
Affected versions
marketplace 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.4, 109.6.0, 109.9.0, 110.0.0
open-vsx 109.10.0, 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.2, 109.7.0, 110.0.0
MEDIUM child-process-exec Extension spawns subprocesses via child_process
node_modules/vscode-languageclient/lib/node/main.js :299
`{file_path}` imports child_process and calls exec / spawn / execFile / fork. Subprocess execution lets the extension pivot from the VSCode host into the user's shell.
}
else if (transport === TransportKind.pipe) {
pipeName = (0, node_1.generateRandomPipeName)();
args.push(`--pipe=${pipeName}`);
}
else if (Transport.isSocket(transport)) {
args.push(`--socket=${transport.port}`);
}
args.push(`--clientProcessId=${process.pid.toString()}`);
if (transport === TransportKind.ipc || transport === TransportKind.stdio) {
▶ const serverProcess = cp.spawn(runtime, args, execOptions);
if (!serverProcess || !serverProcess.pid) {
return handleChildProcessStartError(serverProcess, `Launching server using runtime ${runtime} failed.`);
}
this._serverProcess = serverProcess;
serverProcess.stderr.on('data', data => this.outputChannel.append(Is.string(data) ? data : data.toString(encoding)));
if (transport === TransportKind.ipc) {
serverProcess.stdout.on('data', data => this.outputChannel.append(Is.string(data) ? data : data.toString(encoding)));
return Promise.resolve({ reader: new node_1.IPCMessageReader(serverProcess), writer: new node_1.IPCMessageWriter(serverProcess) });
}
else {
Affected versions
marketplace 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.4, 109.6.0, 109.9.0, 110.0.0
open-vsx 109.10.0, 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.2, 109.7.0, 110.0.0
MEDIUM obfuscated-code Long run of \x hex-escape sequences
node_modules/prettier/plugins/flow.js :14
▶ line 14: \v\f\r\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x1B \x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07 \x07\x07\x07\x07\x07\x07\x07\x07 \x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07…
Affected versions
marketplace 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.4, 109.6.0, 109.9.0, 110.0.0
open-vsx 109.10.0, 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.2, 109.7.0, 110.0.0
MEDIUM obfuscated-code Long run of \x hex-escape sequences
node_modules/prettier/plugins/flow.mjs :14
▶ line 14: \v\f\r\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x1B \x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07 \x07\x07\x07\x07\x07\x07\x07\x07 \x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07…
Affected versions
marketplace 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.4, 109.6.0, 109.9.0, 110.0.0
open-vsx 109.10.0, 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.2, 109.7.0, 110.0.0
MEDIUM child-process-exec Extension spawns subprocesses via child_process
test/grammar/test.js :22
`{file_path}` imports child_process and calls exec / spawn / execFile / fork. Subprocess execution lets the extension pivot from the VSCode host into the user's shell.
.map((file) => join(grammarDir, file));
const allGrammars = [...grammars, ...dummyGrammars];
/**
*
* @param {Parameters<typeof spawn>} arg
* @returns
*/
function promisifySpawn(...arg) {
▶ const childProcess = spawn(...arg);
return new Promise((resolve) => {
childProcess.on('exit', (code) => {
resolve(code);
});
childProcess.on('error', (err) => {
console.error(err);
resolve(1);
});
});
Affected versions
marketplace 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.4, 109.6.0, 109.9.0, 110.0.0
open-vsx 109.10.0, 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.2, 109.7.0, 110.0.0
MEDIUM child-process-exec Extension spawns subprocesses via child_process
node_modules/vscode-languageclient/lib/node/processes.js :25
`{file_path}` imports child_process and calls exec / spawn / execFile / fork. Subprocess execution lets the extension pivot from the VSCode host into the user's shell.
try {
// This we run in Atom execFileSync is available.
// Ignore stderr since this is otherwise piped to parent.stderr
// which might be already closed.
let options = {
stdio: ['pipe', 'pipe', 'ignore']
};
if (cwd) {
options.cwd = cwd;
}
▶ cp.execFileSync('taskkill', ['/T', '/F', '/PID', process.pid.toString()], options);
return true;
}
catch (err) {
return false;
}
}
else if (isLinux || isMacintosh) {
try {
var cmd = (0, path_1.join)(__dirname, 'terminateProcess.sh');
var result = cp.spawnSync(cmd, [process.pid.toString()]);
Affected versions
marketplace 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.4, 109.6.0, 109.9.0, 110.0.0
open-vsx 109.10.0, 109.10.1, 109.11.0, 109.11.1, 109.11.2, 109.12.0, 109.12.1, 109.13.0, 109.14.0, 109.14.1, 109.14.2, 109.15.0, 109.15.1, 109.5.2, 109.7.0, 110.0.0
Embed this verdict
[](https://vsxplorer.veryserious.systems/report/svelte.svelte-vscode)