CVE-2021-21420

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

vscode-stripe is an extension for Visual Studio Code. A vulnerability in Stripe for Visual Studio Code extension exists when it loads an untrusted source-code repository containing malicious settings. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. The update addresses the vulnerability by modifying the way the extension validates its settings.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Apr 1, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-214216.5node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user wCVE-2021-214226.1mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/moCVE-2021-214238.1`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GiCVE-2021-214245.3Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possiblCVE-2021-214259.8Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlieCVE-2021-214269.8Magento-lts is a long-term support alternative to Magento Community Edition (CE). In magento-lts versions 19.4.12 and prior and 20.0.8 and pCVE-2021-214277.2Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 andCVE-2021-214287.0Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuraCVE-2021-214293.3OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI SpCVE-2021-214305.5OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically giCVE-2021-214318.1sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of theCVE-2021-214326.5Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in