CVE-2021-21420 - CVE House
Back to Database
Status published High CVE-2021-21420

Vulnerability in Stripe for Visual Studio Code < 1.7.3

Vulnerability Description

vscode-stripe is an extension for Visual Studio Code. A vulnerability in Stripe for Visual Studio Code extension exists when it loads an untrusted source-code repository containing malicious settings. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. The update addresses the vulnerability by modifying the way the extension validates its settings.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21420

Credits & Attribution

No credits recorded in the NVD database.

References

More from stripe

View All →
CVE-2024-45401
stripe-cli Path Traversal vulnerability
High 7.6
CVE-2022-29188
Smokescreen SSRF via deny list bypass (square brackets) in Smokescreen
Medium 5.3
CVE-2022-24825
Smokescreen SSRF via deny list bypass
Medium 5.8
CVE-2022-24753
Code injection in Stripe CLI on windows
High 7.7
CVE-2018-19249
The Stripe API v1 allows remote attackers to bypass intended...
High 7.5

Affected Vendor

Affected Software

vscode-stripe
Vulnerable Versions:
< 1.7.3

Timeline

Official Publish: April 1st, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-74

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1562 Impair Defenses
Defense Evasion
T1213 Data from Information Repositories
Collection