Read the docs
TI-2019-12546 Aliases CVE-2019-16765GHSA-x3w4-7cmr-9gv2

Path traversal in GitHub vscode-codeql

Priority MEDIUM 42CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-250.

Summary

If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed in version 1.0.1 of the extension. Users should upgrade to this version using Visual Studio Code Marketplace's upgrade mechanism. After upgrading, the codeQL.cli.executablePath setting can only be set in the per-user settings, and not in the per-workspace settings. More information about VS Code settings can be found here.

Why it matters now

EPSS 0.05364 92nd percentileScored 2026-11-07
Fix Fixed vscode-codeql (github): 1.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GitHubvscode-codeql< 1.0.1 to before 1.0.11.0.1Patch availableCNA
  • vscode-codeql VendorGitHub Affected < 1.0.1 to before 1.0.1 Fixed in 1.0.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:codeql:*:*:*:*:*:visual_studio_code:*:*before 1.0.1VulnerableMicrosoft
  • cpe:2.3:a:microsoft:codeql:*:*:*:*:*:visual_studio_code:*:* Versions before 1.0.1 Vulnerable ·Microsoft

Remediation

  • Fix · CNA vscode-codeql (github) Fixed in 1.0.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-16765
  2. 2026-10-03 Alias added: GHSA-x3w4-7cmr-9gv2

References

Patch 1

Advisory 1

Other 1

  • TI-2024-04632 An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES)… CVSS 4.0CRITICAL 10.0
  • TI-2024-00181 Unsafe Reflection in Github Enterprise Server leading to Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2024-00466 Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server CVSS 3.1HIGH 8.8
  • TI-2022-08539 Integer overflow in table parsing extension leads to heap memory corruption CVSS 3.1CRITICAL 9.8
  • TI-2026-34990 GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler CVSS 3.1HIGH 7.5
  • TI-2026-32884 GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor CVSS 4.0HIGH 8.5
See all 178 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences