CVE-2020-17163

Published Dec 29, 2023

Last updated 18 days ago

CVSS high 7.8

Overview

Description: Visual Studio Code Python Extension Remote Code Execution Vulnerability
Source: secure@microsoft.com
NVD status: Modified
Products: python

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:python:*:*:*:*:*:visual_studio_code:*:*",
            "matchCriteriaId": "E284767F-E736-4F84-BE11-AA44BB6D01DA",
            "versionEndExcluding": "2020.9.2",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.•CVE-2026-54981
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.•CVE-2026-15308
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.•CVE-2026-4360
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.•CVE-2026-0864
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.•CVE-2026-7210

References

Sources include official advisories and independent security research.

https://nvd.nist.gov/vuln/detail/CVE-2020-17163
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17163
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17163

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References