Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-19515

WSO2 Integrator: MI for Visual Studio Code · OS command injection

CVSS 3.1 7.0 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-19515

Published

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow. Successful exploitation of this vulnerability could lead to the execution of arbitrary OS commands on the system where the VS Code extension is running. The extent of the impact is dependent on the privileges of the user account under which VS Code is operating. Exploitation requires the user to grant workspace trust to the malicious project and subsequently trigger the unit test execution.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-19515

Published

WSO2 Integrator: MI for Visual Studio Code

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "WSO2",
                    "product": "WSO2 Integrator: MI for Visual Studio Code",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThanOrEqual": "4.1.3",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON