VDB
GCVE-110-OSM-2026-3030
GCVE-110-OSM-2026-3030
Advisory PublishedCVSS 8.8/10
Malicious vscode tasks.json that delivers malware to user device, when the repository is opened as trusted workspace in Visual studio code.
The payload URL in tasks.json aligns with the IOC reported by OSM in TasksJacker campaign, which uses URL Shortener. Attacker controlled infrastructure is hosted on 38[.]92[.]47[.]167
The final payload delivers JS malware.
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
8.8/10
High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | * (affected) | — |
References
Malicious package:
advisory
Browse GCVE Records
73,834 records in the GCVE database · Updated July 19, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.