/* Route-Critical (index, V6 §3.6.3 — erzeugt von tools/generate_critical_css.mjs) */ .collapse:not(.show){display:none}.navbar{display:flex;flex-wrap:wrap;align-items:center;justify-content:space-between}.navbar>.container-fluid{display:flex;flex-wrap:inherit;align-items:center;justify-content:space-between}.mydraft-svg-icon{display:inline-block;vertical-align:middle;color:currentcolor;flex-shrink:0;transition:color var(--duration-fast, 150ms) ease,stroke var(--duration-fast, 150ms) ease,fill var(--duration-fast, 150ms) ease}.mydraft-svg-icon circle,.mydraft-svg-icon line,.mydraft-svg-icon path,.mydraft-svg-icon polygon,.mydraft-svg-icon polyline,.mydraft-svg-icon rect{transition:stroke var(--duration-fast, 150ms) ease,fill var(--duration-fast, 150ms) ease}@layer components{.live-pulse-dot{width:8px;height:8px}}.min-w-0{min-width:0}@layer overrides{.live-radar-header-badge{background:rgba(239,68,68,.12);border:1px solid rgba(239,68,68,.35);color:#fca5a5;font-size:.75rem;font-weight:700;transition:.25s;cursor:pointer}}@layer overrides{.live-pulse-dot{width:8px;height:8px;background-color:var(--threat-critical,#ef4444);border-radius:50%;display:inline-block;box-shadow:rgba(239,68,68,.7) 0 0 0 0}}@layer overrides{body.light .live-radar-header-badge,html[data-bs-theme=light] .live-radar-header-badge{background:#fbd9dd;border-color:#eeb2b8;color:#8a1723!important}}.isharestuff-live-ticker{color:var(--color-text-body,#f8fafc);backdrop-filter:none;flex-wrap:wrap;row-gap:.3rem;background:var(--color-surface,rgba(15,23,42,.85))!important;border:1px solid var(--color-border,rgba(255,255,255,.12))!important;padding:.45rem .5rem!important;margin-bottom:.75rem!important}.ticker-content{mask-image:linear-gradient(to right,transparent 0px,rgb(0,0,0) 14px,rgb(0,0,0) calc(100% - 14px),transparent 100%);touch-action:pan-y;cursor:grab;user-select:none;-webkit-tap-highlight-color:transparent;order:1;width:100%;max-width:100%;flex:0 0 100%!important}.isharestuff-live-ticker .ticker-lead-group{order:2;width:100%;justify-content:space-between;margin-right:0!important}.ticker-track{display:flex;align-items:center;white-space:nowrap;will-change:transform;transform:translate3d(0,0,0);--ticker-speed:1;animation-name:isharestuffTicker;animation-timing-function:linear;animation-iteration-count:infinite;animation-duration:calc(26s / var(--ticker-speed, 1))}.ticker-link{max-width:min(78vw,340px);font-size:.82rem;display:inline-block;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;vertical-align:baseline;transition:color .2s;color:var(--color-text-heading,#f8fafc)!important}.isharestuff-live-ticker .ticker-ctrl-btn{min-width:44px;height:44px;font-size:.78rem;-webkit-tap-highlight-color:transparent}.ticker-controls-bar{gap:.4rem}.ticker-counter{font-family:var(--bs-font-monospace, ui-monospace, monospace);font-size:.72rem;line-height:1;color:var(--color-text-secondary,#94a3b8);min-width:3.4em;text-align:center;user-select:none;white-space:nowrap;margin-left:auto}.ticker-item{font-size:.82rem}.ticker-item .ticker-date{font-size:.72rem;vertical-align:baseline}.ticker-text-group{display:inline-flex;align-items:baseline}.ticker-badge-live-btn{border:0;cursor:pointer;text-decoration:none!important}.ticker-badge{font-size:.78rem!important;min-height:44px!important;min-width:44px!important;padding:6px 12px!important;display:inline-flex!important;align-items:center!important;justify-content:center!important}@media (min-width:992px){.navbar-expand-lg{flex-wrap:nowrap;justify-content:flex-start}.navbar-expand-lg .navbar-toggler{display:none}}@media (prefers-reduced-motion:reduce){@layer overrides{#news-popup,#news-toast-banner,.animate-pulse,.live-pulse-dot,.live-pulsing-dot,.news-item-card{animation:none;transition:none}}.ticker-track{animation:none!important}.ticker-content{cursor:default}}@media (min-width:768px){.isharestuff-live-ticker{flex-wrap:nowrap;row-gap:0;backdrop-filter:blur(12px);padding:.5rem!important;margin-bottom:1rem!important}.isharestuff-live-ticker .ticker-content{order:0;width:auto;max-width:none;flex:1 1 auto!important}.isharestuff-live-ticker .ticker-lead-group{order:0;width:auto;justify-content:flex-start;margin-right:1rem!important}.ticker-controls-bar{gap:.3rem}.isharestuff-live-ticker .ticker-ctrl-btn{min-width:30px;height:auto;font-size:inherit}.ticker-counter{font-size:.66rem;margin-left:0}.ticker-track{animation-duration:calc(40s / var(--ticker-speed, 1))}.ticker-link{max-width:340px;font-size:.85rem}.ticker-item{font-size:.85rem}.ticker-badge{font-size:inherit!important;min-height:0!important;min-width:0!important;padding:.5rem 1rem!important}}@media (max-width:359.98px){.ticker-counter{display:none}.ticker-controls-bar{gap:.3rem}.ticker-badge{padding:6px 9px!important}} 🔒 VSCan: What Scanning Malicious VSCode Extensions Reveals About Agent Tool Privilege Boundaries | Sichere Programmierung – TSECURITY.DE
EILMELDUNGEN LIVE
Podcasts & Audio BriefingsHow GitHub uses AI agents to stress test new features(18.10.2026 um 17:00 Uhr)
•
Windows Tipps & SecurityThe Razer Kiyo V2 Pro is a giant webcam, but it might not be for you(18.10.2026 um 15:00 Uhr)
•
Windows Tipps & SecurityControl: Resonant review — Remedy’s newest chapter is a masterclass in mood, mystery, and world‑building(18.10.2026 um 15:45 Uhr)
•
Windows Tipps & SecurityWindows 11’s Search overhaul is coming fast — here’s what you really need to know(18.10.2026 um 15:59 Uhr)
•
Windows Tipps & SecurityWindows Wrap: The best PC Microsoft has ever made — and the OS that might be holding it back(18.10.2026 um 16:25 Uhr)
•
Windows Tipps & Security“This isn’t sustainable.” WoW’s 8‑week patch cadence is reaching a breaking point(18.10.2026 um 16:36 Uhr)
•
Windows Tipps & SecurityGlow(18.10.2026 um 15:47 Uhr)
•
Windows ServerDownload der Woche: Impacket - IT-Administrator.de(18.10.2026 um 15:01 Uhr)
•
Windows Tipps & SecurityWindows 11: Microsoft blockiert bald alle externen Laufwerke mit ReFS - WinFuture.de(18.10.2026 um 17:04 Uhr)
•
Video AnalysenThe Morpheus: Habt ihr schon euren (Um)Weg in die Cybersecurity gefunden? #tech #cybersecurity(18.10.2026 um 17:00 Uhr)
•
Podcasts & Audio BriefingsHow GitHub uses AI agents to stress test new features(18.10.2026 um 17:00 Uhr)
•
Windows Tipps & SecurityThe Razer Kiyo V2 Pro is a giant webcam, but it might not be for you(18.10.2026 um 15:00 Uhr)
•
Windows Tipps & SecurityControl: Resonant review — Remedy’s newest chapter is a masterclass in mood, mystery, and world‑building(18.10.2026 um 15:45 Uhr)
•
Windows Tipps & SecurityWindows 11’s Search overhaul is coming fast — here’s what you really need to know(18.10.2026 um 15:59 Uhr)
•
Windows Tipps & SecurityWindows Wrap: The best PC Microsoft has ever made — and the OS that might be holding it back(18.10.2026 um 16:25 Uhr)
•
Windows Tipps & Security“This isn’t sustainable.” WoW’s 8‑week patch cadence is reaching a breaking point(18.10.2026 um 16:36 Uhr)
•
Windows Tipps & SecurityGlow(18.10.2026 um 15:47 Uhr)
•
Windows ServerDownload der Woche: Impacket - IT-Administrator.de(18.10.2026 um 15:01 Uhr)
•
Windows Tipps & SecurityWindows 11: Microsoft blockiert bald alle externen Laufwerke mit ReFS - WinFuture.de(18.10.2026 um 17:04 Uhr)
•
Video AnalysenThe Morpheus: Habt ihr schon euren (Um)Weg in die Cybersecurity gefunden? #tech #cybersecurity(18.10.2026 um 17:00 Uhr)
•
Intelligence View
⚡ tsecurity.de Intelligence

VSCan: What Scanning Malicious VSCode Extensions Reveals About Agent Tool Privilege Boundaries

VSCode extensions run with full file system, network, and credential access. No sandbox. No capability manifest. No runtime enforcement. Dozens of malicious…

Sichere Programmierung DEV Community 1 Min. Lesezeit
Beitrag
0
Seite
0
↗ Quelle (DEV Community)
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!

VSCode extensions run with full file system, network, and credential access. No sandbox. No capability manifest. No runtime enforcement. Dozens of malicious extensions have already shipped through the official marketplace, and the only defense most developers have is trust plus post-compromise detection. This is the same privilege boundary problem... Weiterlesen: VSCan: What Scanning Malicious VSCode Extensions Reveals About Agent …

Powered by tsecurity.de tsecurity.de Hub
🚀 Auf tsecurity.de entdecken
Intelligence Digest — free The top security news daily · unsubscribe anytime
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
No reader ratings yet
Was this page helpful?
0
Jetzt Bewertung abgeben
🟢 Niedrig (1-3.9) 🟡 Mittel (4.0-6.9) 🔴 Hoch (7.0-8.9) Kritisch (9.0-10.0)
Powered by tsecurity.de tsecurity.de Hub
🚀 Auf tsecurity.de entdecken

Related story clusters & sources (vector AI)

19 sources
CVE-2019-13631 | Linux Kernel up to 5.2.1 USB Device gtco.c parse_hid_report_descriptor HID Report out-of-bounds write (ID 154059 / Nessus ID 366954)
18 more sources
VulDB Updates3 hours agoCVE-2019-15505 | Linux Kernel up to 5.2.9 USB Device technisat-usb2.c out-of-bounds (K28222050 / Nessus ID 366954) VulDB Updates3 hours agoCVE-2021-33631 | openEuler Kernel prior 4.19.90-2401.3/5.10.0-183.0.0 on Linux Filesystem integer overflow (Nessus ID 366952 / WID-SEC-2024-1086) VulDB Updates3 hours agoCVE-2023-52707 | Linux Kernel up to 5.4.231/5.10.168/5.15.94/6.1.12 ep_remove_wait_queue use after free (Nessus ID 366951) VulDB Updates3 hours agoCVE-2021-3640 | Linux Kernel HCI Subsystem sco_sock_sendmsg use after free (Nessus ID 366948) VulDB Updates3 hours agoCVE-2021-46939 | Linux Kernel up to 5.12.2 tracing trace_clock_global recursion (Nessus ID 366947) VulDB Updates3 hours agoCVE-2021-4093 | Linux Kernel KVM out-of-bounds write (Nessus ID 366945)
+12
11 sources
CVE-2026-111888 | thorsten phpMyFAQ up to 4.1.8 /admin/api/news/update improper authorization (EUVD-2026-103331)
10 more sources
VulDB Updates2 hours agoCVE-2026-109640 | Frappe ERPNext up to 16.21.x improper authorization (EUVD-2026-98031) VulDB Updates2 hours agoCVE-2026-108642 | JeecgBoot up to 3.9.5 Announcement Send list SysAnnouncementSendController improper authorization (EUVD-2026-96581) VulDB Updates2 hours agoCVE-2026-108637 | JeecgBoot up to 3.9.5 User Group Member Removal deleteUserGroupBatch groupId/userIds improper authorization (EUVD-2026-96576) VulDB Updates2 hours agoCVE-2026-108632 | JeecgBoot up to 3.9.5 Department Permission Controller queryById SysDepartPermissionController.queryById id improper authorization (EUVD-2026-96571) VulDB Updates2 hours agoCVE-2026-108667 | JeecgBoot up to 3.9.5 Revert Recycle Bin revertRecycleBin improper authorization (EUVD-2026-96606) VulDB Updates2 hours agoCVE-2026-108662 | JeecgBoot up to 3.9.5 deleteTenantPackUser userId/packId improper authorization (EUVD-2026-96601)
+4
11 sources
CVE-2026-110026 | Tasty Recipes Lite Plugin up to 1.2.10 on WordPress authorization (EUVD-2026-103391)
10 more sources
VulDB Updates3 hours agoCVE-2026-109937 | Otter Blocks Plugin up to 3.2.2 on WordPress redirect (EUVD-2026-103390) VulDB Updates3 hours agoCVE-2026-110976 | AI Engine Plugin up to 3.7.8 on WordPress authorization (EUVD-2026-103398) VulDB Updates3 hours agoCVE-2026-87844 | PickPlugins Product Designer for WooCommerce Plugin up to 1.0.40 on WordPress authorization (EUVD-2026-103389) VulDB Updates3 hours agoCVE-2026-110070 | Modern Events Calendar Lite Plugin up to 7.36.3 on WordPress authorization (EUVD-2026-103397) VulDB Updates3 hours agoCVE-2026-110069 | Modern Events Calendar Lite Plugin up to 7.36.x on WordPress information disclosure (EUVD-2026-103396) VulDB Updates3 hours agoCVE-2026-110035 | Salon Booking System Plugin up to 10.31.10 on WordPress REST API Endpoint access control (EUVD-2026-103395)
+4

Mehr aus dieser Kategorie

Schluss mit Gmail und Outlook: Diese europäischen Alternativen schützen deine Daten
18.10.2026
How to prepare for a meta engineer interview
18.10.2026
Why my Electron renderer can't change anything itself
18.10.2026
Preventing Temporary Table Race Conditions and Namespace Pollution in Concurrent Batch Architectures
18.10.2026
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
Pull to refresh
TTS Reader • tsecurity.de Voice
Nächster Beitrag