Read the docs
TI-2022-16401 Aliases CVE-2022-35976

Improper KubeConfig handling allows arbitrary code execution

Priority MEDIUM 43CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary code execution on behalf of the user running VSCode. Users relying on kubeconfigs that are generated or altered by other processes or users are affected by this issue. Please note that the vulnerability is specific to this extension, and the same kubeconfig would not result in arbitrary code execution when used with kubectl. Using only trust-worthy kubeconfigs is a safe mitigation. However, updating to the latest version of the extension is still highly recommended.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00539 45th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
weaveworksvscode-gitops-tools0.5.0 – 0.20.9—No fix listedCNA
  • vscode-gitops-tools Vendorweaveworks Affected 0.5.0 – 0.20.9 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:weave:gitops_tools:*:*:*:*:*:visual_studio_code:*:*0.5.0 – 0.20.9VulnerableWeave
  • cpe:2.3:a:weave:gitops_tools:*:*:*:*:*:visual_studio_code:*:* Versions 0.5.0 – 0.20.9 Vulnerable ·Weave

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-35976

References

Advisory 1

  • TI-2022-16400 Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCode CVSS 3.1CRITICAL 9.8
  • TI-2022-13142 Weave GitOps leaked cluster credentials into logs on connection errors CVSS 3.1CRITICAL 9.0
  • TI-2022-07567 GitOps Run allows for Kubernetes workload injection CVSS 3.1HIGH 8.9
  • TI-2023-17072 Information Disclosure Vulnerability in Weave GitOps Terraform Controller CVSS 3.1HIGH 8.5
  • TI-2020-16099 Weave Net Pods running in host PID namespace can be used to escalate other Kubernetes vulnerabilities CVSS 3.1HIGH 8.0
  • TI-2022-07568 Weave Gitops Run vulnerable to insecure communication CVSS 3.1HIGH 7.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences