CVE-2019-18212

Published October 23rd, 2019

View on NVD ↗

CVSS v3

6.5

MEDIUM

CVSS v2

MEDIUM

Affected

PROJECTS

Description

XMLLanguageService.java in XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows a remote attacker to write to arbitrary files via Directory Traversal.

redhat-developer/vscode-xml

Editing XML in Visual Studio Code made easy

GitHub

319

eclipse-lemminx/lemminx

XML Language Server

GitHub

354