A code security update has been released for Arch Linux.

ASA-202107-34: code: arbitrary code execution

Arch Linux Security Advisory ASA-202107-34
=========================================
Severity: Medium
Date : 2021-07-20
CVE-ID : CVE-2021-31211 CVE-2021-31214
Package : code
Type : arbitrary code execution
Remote : Yes
Link :   https://security.archlinux.org/AVG-1963

Summary
======
The package code before version 1.58.0-1 is vulnerable to arbitrary
code execution.

Resolution
=========
Upgrade to 1.58.0-1.

# pacman -Syu "code>=1.58.0-1"

The problems have been fixed upstream in version 1.58.0.

Workaround
=========
None.

Description
==========
- CVE-2021-31211 (arbitrary code execution)

An arbitrary code execution vulnerability through crafted remote
terminal settings has been found in Visual Studio Code before version
1.57.0.

- CVE-2021-31214 (arbitrary code execution)

An arbitrary code execution vulnerability in the Grunt, Gulp and Jake
task auto detection has been found in Visual Studio Code before version
1.57.0.

Impact
=====
An attacker could execute arbitrary code through crafted remote
terminal settings or JavaScript task runner configuration files without
user interaction.

References
=========
  https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31211
  https://github.com/microsoft/vscode/issues/123590
  https://github.com/microsoft/vscode/commit/7259955ce318a2bb2a86ee121c34dcaab0a86e45
  https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31214
  https://github.com/microsoft/vscode/issues/123588
  https://github.com/microsoft/vscode/commit/5f3466a21e80b2c016a1c0cbe2af683c9072d0a7
  https://security.archlinux.org/CVE-2021-31211
  https://security.archlinux.org/CVE-2021-31214