Read the docs
TI-2022-16400 Aliases CVE-2022-35975

Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCode

Priority MEDIUM 46CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users using the VSCode extension to manage clusters that are shared amongst other users are affected by this issue. The only safe mitigation is to update to the latest version of the extension.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01409 72nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
weaveworksvscode-gitops-tools0.7.0 – 0.20.2—No fix listedCNA
  • vscode-gitops-tools Vendorweaveworks Affected 0.7.0 – 0.20.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:weave:gitops_tools:*:*:*:*:*:visual_studio_code:*:*0.7.0 – 0.20.2VulnerableWeave
  • cpe:2.3:a:weave:gitops_tools:*:*:*:*:*:visual_studio_code:*:* Versions 0.7.0 – 0.20.2 Vulnerable ·Weave

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-35975

References

Advisory 1

  • TI-2022-16401 Improper KubeConfig handling allows arbitrary code execution CVSS 3.1CRITICAL 9.8
  • TI-2022-13142 Weave GitOps leaked cluster credentials into logs on connection errors CVSS 3.1CRITICAL 9.0
  • TI-2022-07567 GitOps Run allows for Kubernetes workload injection CVSS 3.1HIGH 8.9
  • TI-2023-17072 Information Disclosure Vulnerability in Weave GitOps Terraform Controller CVSS 3.1HIGH 8.5
  • TI-2020-16099 Weave Net Pods running in host PID namespace can be used to escalate other Kubernetes vulnerabilities CVSS 3.1HIGH 8.0
  • TI-2022-07568 Weave Gitops Run vulnerable to insecure communication CVSS 3.1HIGH 7.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences