By weakness (CWE)
CWE-494: related vulnerabilities
CVEs classified under CWE-494. Understanding the weakness class helps prioritize systemic fixes over one-off patches.
5 published vulnerabilities
- CVE-2026-49241HIGH 8.8
The Angular Language Service VS Code Extension allows developers to write Angular code with advanced IDE features like autocomplete and error checking. A critical flaw in versions before 21.2.4 lets an attacker hide malicious code in a project repository that automatically executes when a developer opens that folder in VS Code. The attack works by placing a fake TypeScript library file in the repository and configuring VS Code settings to point to it—the extension loads and runs this fake library without asking permission or checking if the workspace is trusted. An attacker only needs to commit the malicious code to a repository (like on GitHub) and wait for developers to clone and open it.
- CVE-2026-55698HIGH 8.8
pnpm, a popular Node.js package manager, contains a vulnerability in versions before 10.34.2 and 11.5.3 that allows malicious repositories to inject and execute arbitrary code during package manager installation. The issue stems from pnpm's trust in cached package-manager metadata within the pnpm-lock.yaml file. When a repository commits a specially crafted lockfile with matching pnpm and @pnpm/exe versions, pnpm may skip fresh resolution of the package manager itself and instead execute code from the attacker-controlled lockfile during automatic version switching. An attacker would need to trick a developer into cloning and running commands in a malicious repository, but no special credentials or authenticated access is required.
- CVE-2021-47986HIGH 7.5
Parse Server versions before 4.10.0 contain a supply chain vulnerability caused by incorrect version tags pushed to the official repository. These tags pointed to unreviewed code residing in a personal developer fork rather than the main codebase. An attacker could exploit this by tricking developers into declaring one of these malicious version tags as a dependency, causing their builds to pull and execute potentially harmful code. The vulnerability exploits the trust developers place in official version numbers and repository tags.
- CVE-2021-47987HIGH 7.5
Parse Server experienced a supply chain incident where unauthorized version tags were pushed to its official repository, pointing to an unreviewed fork controlled by a contributor with write access. While no malicious code was confirmed, the unreviewed nature of these tags created significant risk. Organizations using git-based dependencies directly referencing affected tags (such as parse-server#4.9.3) faced exposure to potentially unvetted code. The incident highlights the importance of dependency pinning and repository access controls.
- CVE-2026-55697HIGH 7.5
pnpm, a widely-used JavaScript package manager, has a vulnerability that allows attackers to execute arbitrary code on a developer's or CI system during package installation. The vulnerability exists in how pnpm handles special dependencies declared in workspace configuration files. An attacker who controls a repository can declare a malicious package as a configuration dependency, which pnpm will then download and execute without proper safeguards. This affects pnpm versions before 10.34.2 and 11.5.3.