CVE-2021-22539: Code execution in VSCode-bazel via malicious Bazel config files

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-16 · updated 2026-06-17
Weakness: CWE-73

Description

An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recommend upgrading to version 0.4.1 or above.

Affected products

Google LLC Bazel: from 0.1.0 before 0.4.1 — fixed in 0.4.1

How to fix

Upgrade to a fixed version: Google LLC Bazel 0.4.1. Check the vendor advisory for mitigations.

References

https://github.com/bazelbuild/vscode-bazel-ghsa-2rcw-j8x4-hgcv/pull/1
https://github.com/bazelbuild/vscode-bazel/security/advisories/GHSA-2rcw-j8x4-hgcv
https://github.com/bazelbuild/vscode-bazel-ghsa-2rcw-j8x4-hgcv/pull/1
https://github.com/bazelbuild/vscode-bazel/security/advisories/GHSA-2rcw-j8x4-hgcv

Get alerted when CVE-2021-22539 or the next vulnerability affects your stack