Description

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow. Successful exploitation of this vulnerability could lead to the execution of arbitrary OS commands on the system where the VS Code extension is running. The extent of the impact is dependent on the privileges of the user account under which VS Code is operating. Exploitation requires the user to grant workspace trust to the malicious project and subsequently trigger the unit test execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-15T10:17:02.960Z",
  "pubdate": "2026-09-15T10:17:02.960Z",
  "executiveSummary": "The WSO2 Integrator MI VS Code extension contains a critical command injection vulnerability stemming from improper input sanitization during the processing of Micro Integrator projects. An attacker can craft a malicious project folder containing specially formatted input that, when processed by the extension, triggers arbitrary operating system command execution.\nThe vulnerability poses a severe risk to system integrity and confidentiality, as successful exploitation allows the execution of code with the privileges of the user running the VS Code instance. This flaw is primarily mitigated by the requirement for a user to grant 'workspace trust' to the malicious project and explicitly initiate the unit test execution process. Once triggered, the attacker achieves remote code execution capabilities on the host environment.\nThis vulnerability highlights a critical failure in handling untrusted workspace data, which is a common vector for development environment compromises. Users are advised to exercise extreme caution when opening projects from unverified sources.",
  "technicalDetails": "The root cause of this vulnerability is the lack of robust input validation and sanitization within the unit test execution flow of the WSO2 Integrator MI VS Code extension. The extension facilitates project development by automating various tasks, including the execution of unit tests for Micro Integrator artifacts. During this process, the extension incorrectly processes configuration files or project metadata provided within a project workspace.\nWhen a user opens a malicious Micro Integrator project, the extension parses files that influence the unit test runner's parameters. Because these inputs are passed directly to the underlying system shell or command execution APIs without adequate escaping or parameterization, an attacker can perform command injection. By injecting shell metacharacters into specific project configuration fields, an attacker can force the extension to execute unintended commands at the OS level.\nThe attack flow follows a structured path: first, an attacker distributes a crafted WSO2 Micro Integrator project archive. Second, the victim must open this project in VS Code and, crucially, grant it 'workspace trust', which allows the extension to function. Third, the attacker relies on the victim to trigger the unit test execution functionality via the IDE's interface. Upon invocation, the vulnerable component passes the malicious payload from the project's configuration files to the system interpreter. The system then executes the attacker-defined commands within the context of the VS Code process.\nThe impact is determined by the permissions assigned to the user account operating the IDE. If VS Code is executed with elevated or standard user permissions, the injected commands will inherit those same rights, enabling activities such as data exfiltration, installation of persistent backdoors, or lateral movement within the network. This vulnerability is strictly client-side, requiring local user interaction with an untrusted project folder to initiate the exploitation sequence."
}