VDB
GCVE-110-OSM-2026-2633
GCVE-110-OSM-2026-2633
Advisory PublishedCVSS 8.8/10
Malicious tasks.json file that delivers malware to the user device, if the workspace opened as trusted workspace in visual studio code.
This payload in tasks.json uses known URL shortner that are indicators of TasksJacker campaign. The payload is hosted at 38[.]92[.]47[.]167
IOCs:
- c2 url: http://38.92.47.167:3000/task/windows?token=302450aa67dc
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
8.8/10
High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | * (affected) | — |
References
Malicious package:
advisory
Browse GCVE Records
72,921 records in the GCVE database · Updated July 15, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.