CVE-2026-19515

The WSO2 Integrator MI Visual Studio Code extension improperly sanitizes user-supplied input when opening Micro Integrator projects from untrusted sources, enabling OS command injection (CWE-78) through the unit test execution flow. An attacker crafts a malicious Micro Integrator project, and when a developer opens it, grants VS Code workspace trust, and runs unit tests, arbitrary operating system commands execute on the developer's machine with that user's privileges. Successful exploitation can result in full compromise of confidentiality, integrity, and availability of the workstation, limited only by the rights of the account running VS Code. The flaw affects developers using the WSO2 Integrator MI extension who open projects obtained from untrusted sources such as public repositories or third parties. Exploitation requires user interaction and there is no evidence of in-the-wild exploitation or a public proof of concept at this time.

What to do: Update the WSO2 Integrator MI VS Code extension to the latest version as soon as a fixed release ships per WSO2's security advisory. Until then, avoid opening Micro Integrator projects from untrusted sources, do not grant workspace trust to unfamiliar projects, and do not run unit tests on imported projects of unknown provenance. Inspect any recently opened untrusted projects for signs of tampering or unexpected command execution.