GCVE-110-OSM-2026-4913

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published May 29, 2026

Malicious package detected. Behaviors: code execution. Microsoft removal context: Extension ID: eclipse-cdt.vscode-clangd-cdtcloud Publisher: eclipse-cdt Removal Date: 5/24/2026 Violation Type: impersonation Removed from the VS Code Marketplace by Microsoft for violating marketplace policies. Source: https://github.com/microsoft/vsmarketplace/blob/main/RemovedPackages.md Payload: out/bundle.js Key findings: - Shell Command Execution in out/bundle.js: "require("child_process")" IOCs: - urls: https://clangd.llvm.org, http://clang.llvm.org/docs/JSONCompilationDatabase.html, https://clang.llvm.org/extra/clang-tidy/, https://clangd.llvm.org/guides/include-cleaner, https://clang.llvm.org/docs/ClangFormatStyleOptions.html (+4 more) - domains: clangd.llvm.org, clang.llvm.org, llvm.org, lists.llvm.org, t.global (+4 more) - emails: clangd-dev@lists.llvm.org - payloadFileHash: d753d479428fdfe28725bdd2319f80a57e32a8239e7b30f67b9243e3270dd1da

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	eclipse-cdt.vscode-clangd-cdtcloud	0.1.0 (affected)	—

References

Malicious vscode package: eclipse-cdt.vscode-clangd-cdtcloud

advisory

vendor

Browse GCVE Records

73,442 records in the GCVE database · Updated July 17, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON