CVE Daily – Bazel https://cvedaily.com/pages/tags/bazel.html CVE Daily – Bazel en Wed, 03 Jun 2026 21:27:08 +0000 [Low] CVE-2024-5899 – When Bazel Plugin in intellij imports a project (either using "import project" o... https://nvd.nist.gov/vuln/detail/CVE-2024-5899 https://nvd.nist.gov/vuln/detail/CVE-2024-5899 Tue, 18 Jun 2024 09:15:09 +0000 Low CVE-2024-5899

When Bazel Plugin in intellij imports a project (either using "import project" or "Auto import") the dialog for trusting the project is not displayed. This comes from the fact that both call the method ProjectBuilder.createProject which then calls ProjectManager.getInstance().createProject. This method, as its name suggests is intended to create a new project, not to import an existing one.  We r…

CVSS: 3.3 · CWE: CWE-862

View on NVD

]]> [Medium] CVE-2022-3474 – A bad credential handling in the remote assets API for Bazel versions prior to 5... https://nvd.nist.gov/vuln/detail/CVE-2022-3474 https://nvd.nist.gov/vuln/detail/CVE-2022-3474 Wed, 26 Oct 2022 19:15:16 +0000 Medium CVE-2022-3474

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.

CVSS: 4.3 · CWE: CWE-522

View on NVD

]]> [High] CVE-2021-22539 – An attacker can place a crafted JSON config file into the project folder pointin... https://nvd.nist.gov/vuln/detail/CVE-2021-22539 https://nvd.nist.gov/vuln/detail/CVE-2021-22539 Fri, 16 Apr 2021 11:15:12 +0000 High CVE-2021-22539

An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recommend upgrading to version 0.4.1 or above.

CVSS: 8.2 · CWE: CWE-73

View on NVD

]]>