← Back

Bazel

bazel

Vendor: Google • 2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-3474
1Google
1Bazel
Jun 17, 2026
Oct 26, 2022
5.1 MEDIUM· v4
4.3 MEDIUM· v3
N/A· v2
A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions la...Show more
A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.Show less
CVE-2021-22539
1Google
1Bazel
Jun 17, 2026
Apr 16, 2021
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is...Show more
An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recommend upgrading to version 0.4.1 or above.Show less