CVE-2022-35975 - CVE House

Back to Database

Status published Critical CVE-2022-35975

Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCode

9 CVSS

Vulnerability Description

The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users using the VSCode extension to manage clusters that are shared amongst other users are affected by this issue. The only safe mitigation is to update to the latest version of the extension.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-35975

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://github.com/weaveworks/vscode-gitops-tools/security/advisories/GHSA-873x-829r-gxcp

More from weaveworks

View All →

Information Disclosure Vulnerability in Weave GitOps Terraform Controller

Improper KubeConfig handling allows arbitrary code execution

Weave GitOps leaked cluster credentials into logs on connection errors

Weave Gitops Run vulnerable to insecure communication

GitOps Run allows for Kubernetes workload injection

Affected Vendor

weaveworks

View all reports →

Affected Software

vscode-gitops-tools

Vulnerable Versions:

>= 0.7.0, <= 0.20.2

Timeline

Official Publish: August 18th, 2022

Last Modified: April 23rd, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1005 Data from Local System

T1041 Exfiltration Over C2 Channel