← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-phrf-cwfr-v2rw: CSP-Bypassing Webview Script Injection & Path Traversal in MarketplaceViewProvider (AmadeusITGroup/ai-primitives-hub)

[ACCEPTED BY VENDOR (DRAFT GHSA) • PRIVATE REMEDIATION FORK ACTIVE]
Privately reported to AmadeusITGroup/ai-primitives-hub via GitHub Private Vulnerability Reporting (GHSA-phrf-cwfr-v2rw). Accepted by Amadeus security maintainers with coordinated remediation fork created for VS Code extension webview containment and URI scheme validation.

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-phrf-cwfr-v2rw",
  "repository": "AmadeusITGroup/ai-primitives-hub",
  "html_url": "https://github.com/AmadeusITGroup/ai-primitives-hub/security/advisories/GHSA-phrf-cwfr-v2rw",
  "state": "draft (accepted by vendor, private remediation fork active)",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter"
    }
  ],
  "cwe_ids": [
    "CWE-79",
    "CWE-22"
  ],
  "impact": "High (Cross-Site Scripting via Webview / Path Traversal in VS Code Extension Runtime)"
}