CVE-2026-89116
5.9MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-78
Impact
Attackers can execute arbitrary OS commands with the developer's privileges via a malicious project workspace. To trigger execution, a developer must open a untrusted project and initiate generator installation.
Root cause
The extension passes the unsanitized ApplicationWizard.installationLocation workspace setting directly into child_process.execSync via a shell string.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Fix & remediation
Check the advisory for the patched release and update the SAP App Studio Toolkit extension. In the meantime, avoid opening untrusted workspaces or audit .vscode/settings.json to verify ApplicationWizard.installationLocation is not tampered with.
$ code --list-extensions --show-versions | grep -i app-studio-toolkitAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value. Because the value was passed directly to the shell without sanitisation, a malicious workspace repository could craft a settings.json that injects OS commands when a developer opens the project and triggers a generator installation.