VDB
GCVE-110-OSM-2026-432
GCVE-110-OSM-2026-432
Advisory PublishedCVSS 8.8/10
Malicious package detected. Behaviors: code execution.
Microsoft removal context:
Extension ID: eclipse-cdt.vscode-clangd-cdtcloud
Publisher: eclipse-cdt
Removal Date: 5/24/2026
Violation Type: impersonation
Removed from the VS Code Marketplace by Microsoft for violating marketplace policies.
Source: https://github.com/microsoft/vsmarketplace/blob/main/RemovedPackages.md
Payload: out/bundle.js
Key findings:
- Shell Command Execution in out/bundle.js: "require("child_process")"
IOCs:
- urls: https://clangd.llvm.org, http://clang.llvm.org/docs/JSONCompilationDatabase.html, https://clang.llvm.org/extra/clang-tidy/, https://clangd.llvm.org/guides/include-cleaner, https://clang.llvm.org/docs/ClangFormatStyleOptions.html (+4 more)
- domains: clangd.llvm.org, clang.llvm.org, llvm.org, lists.llvm.org, t.global (+4 more)
- emails: clangd-dev@lists.llvm.org
- payloadFileHash: d753d479428fdfe28725bdd2319f80a57e32a8239e7b30f67b9243e3270dd1da
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
8.8/10
High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | potstok.dotnet-runtime-extension | all (affected), all (affected), all (affected), * (affected), all (affected), all (affected) | — |
| unknown | eclipse-cdt.vscode-clangd-cdtcloud | 0.1.0 (affected) | — |
| unknown | pubruncode.ccoderunner | all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), * (affected), * (affected) | — |
| unknown | dep-labs-studio.dep-proffesinal-extension | all (affected) | — |
| unknown | pretty-studio-advisor.prettyxml-formatter | all (affected) | — |
References
Browse GCVE Records
73,866 records in the GCVE database · Updated July 19, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.