CVE-2026-19515— OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution
Quick assessment
Affected
WSO2 WSO2 Integrator: MI for Visual Studio Code
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WSO2 Integrator MI 的 VS Code 扩展在处理来自不可信源打开的 Micro Integrator 项目时，未能对用户输入进行适当的净化或验证。这使得精心构造的项目能够通过单元测试执行流程注入并执行任意操作系统命令。 成功利用此漏洞可在 VS Code 扩展运行的系统上执行任意操作系统命令。影响范围取决于 VS Code 运行所使用的用户账户权限。利用该漏洞需要用户先为恶意项目授予工作区信任（workspace trust），随后触发单元测试执行。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19515
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution
Source: CVE Program / CVE List V5
Vulnerability Description
The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow.
Successful exploitation of this vulnerability could lead to the execution of arbitrary OS commands on the system where the VS Code extension is running. The extent of the impact is dependent on the privileges of the user account under which VS Code is operating. Exploitation requires the user to grant workspace trust to the malicious project and subsequently trigger the unit test execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WSO2 | WSO2 Integrator: MI for Visual Studio Code | 0 ~ 4.1.3 | - |
|
II. Public POCs for CVE-2026-19515
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19515
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-19515 (1)
-
🔗 Page not found - WSO2 Security and Compliance Documentation vendor-advisory
Same Patch Batch · WSO2 · 2026-09-15 · 3 CVEs total
| CVE-2025-5802 | 5.3 MEDIUM | Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Acco |
| CVE-2025-13166 | 3.7 LOW | Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discover |
IV. Related Vulnerabilities
Same vendor: WSO2
-
CVE-2025-13166
Username Enumeration via SMS OTP Flow in WSO2 Identity Serve -
CVE-2025-5802
Username Enumeration via Self Registration Flow in Multiple -
CVE-2026-4103
Cross-Site Scripting via HTML Sanitization in WSO2 Publisher -
CVE-2026-3096
Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 P -
CVE-2025-12737
Arbitrary Code Execution via Administrative Operations in Mu
Same weakness: CWE-78
-
CVE-2026-89308
Arbitrary command execution in TrxTimeATTENDANCE -
CVE-2026-57133
PraisonAI utility shell safe-command wrapper allowlist bypas -
CVE-2026-57136
PraisonAI SandboxExecutor allowedCommands bypass via shell c -
CVE-2026-77853
FF-RFI079I4/078I4 M-Plane操作系统命令注入漏洞 -
CVE-2026-90847
EFM ipTIME C200E System Setup iux_set.cgi os command injecti
V. Comments for CVE-2026-19515
No comments yet