What is CVE-2024-9145?

CVE-2024-9145 is a vulnerability in Wiz Code Visual Studio Extension, classified under Command Injection. Published 2024-10-01.

Is CVE-2024-9145 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Wiz Code Visual Studio Extension

CVE-2024-9145

Wiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerable to local command injection if the user opens a maliciously crafted Dockerfile located in a path that has been marked as a "trusted folder" within Visual Studio Code, and initiates a manual scan of the file.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.008 (51.8th percentile) — read the EPSS interpretation.

Affected products

Wiz Code Visual Studio Extension — versions 1.0.0, 0.13.0

Weakness classification (CWE)

CWE-77 — Command Injection

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

Frequently asked questions

What is CVE-2024-9145?: CVE-2024-9145 is a vulnerability in Wiz Code Visual Studio Extension, classified under Command Injection. Published 2024-10-01.
Is CVE-2024-9145 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.