CVE-2021-29261

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace configuration.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/sveltejs/language-tools/commit/5d7bf1fd98bfe2cd2080863a3c95ce099b898075Patch, Third Party Advisory
https://github.com/sveltejs/language-tools/releasesThird Party Advisory
https://github.com/sveltejs/language-tools/releases/tag/extensions-104.8.0Release Notes, Third Party Advisory
https://marketplace.visualstudio.com/items?itemName=svelte.svelte-vscodeProduct, Third Party Advisory
https://vuln.ryotak.me/advisories/3Third Party Advisory
https://github.com/sveltejs/language-tools/commit/5d7bf1fd98bfe2cd2080863a3c95ce099b898075Patch, Third Party Advisory
https://github.com/sveltejs/language-tools/releasesThird Party Advisory
https://github.com/sveltejs/language-tools/releases/tag/extensions-104.8.0Release Notes, Third Party Advisory
https://marketplace.visualstudio.com/items?itemName=svelte.svelte-vscodeProduct, Third Party Advisory
https://vuln.ryotak.me/advisories/3Third Party Advisory

Timeline

Published: Apr 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-292627.5When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no CVE-2021-292637.8In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS.CVE-2021-292645.5An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar.c in the Freescale Gianfar Ethernet driv CVE-2021-292654.7An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a de CVE-2021-292667.8An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v->config_ctx has an invalid va CVE-2021-292676.1Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to attack help-desk staf CVE-2021-292716.1remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: Locator{URL:" followed by an XSS payload. This is related to backend/app/stor CVE-2021-292726.1bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism CVE-2021-292746.1Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.CVE-2021-292797.8There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1. In which, the arg const GF_PropertyV CVE-2021-292806.4In TP-Link Wireless N Router WR840N an ARP poisoning attack can cause buffer overflow CVE-2021-292819.8File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which