Hello Team.

I hope you are doing well. I am reaching out to inform you of a critical security matter. After cloning the repository, I have identified several vulnerabilities across multiple dependencies. These issues range in severity.

Key Vulnerabilities identified:

Sandbox Bypass [Critical Severity][https://security.snyk.io/vuln/SNYK-JS-VM2-1585918] in [email protected]
Remote Code Execution (RCE) [Critical Severity][https://security.snyk.io/vuln/SNYK-JS-VM2-5772823] in [email protected]

Upgrading these dependencies will not only resolve the current vulnerabilities but will also enhance the overall security posture of the project.

Environment:

OS

Ubuntu 22.04.3 LTS

VSCode

Version: 1.84.2
Commit: 1a5daa3a0231a0fbba4f14db7ec463cf99d7768e
Date: 2023-11-09T10:50:47.800Z
Electron: 25.9.2
ElectronBuildId: 24603566
Chromium: 114.0.5735.289
Node.js: 18.15.0
V8: 11.4.183.29-electron.0
OS: Linux x64 6.2.0-36-generic

Demo of issue:

Steps to reproduce

1. Install instant mongo extension
2. Click "Start DB Server"
3. Wait for however long before deciding nothing is going to happen
4. Click "Start DB Server" and note the "already running" error in the extension host log

Troubleshooting steps

• Reinstalled extension
• Tried using "Instant Mongo: Stop DB"
• Tried using the actions menu to open information about instance (doesn't open)
• Searched for listening ports using ss|grep mongo & ss|grep instant but didn't see anything
• Googled around looking for other things to try :)

• Issue Type: Performance
• Extension Name: instant-mongo
• Extension Version: 1.0.5
• OS Version: Windows_NT x64 10.0.18363
• VSCode version: 1.45.0

⚠️ Make sure to attach this file from your home-directory:
⚠️C:\Users\Isco\hansvn.instant-mongo-unresponsive.cpuprofile.txt

Find more details here: https://github.com/microsoft/vscode/wiki/Explain-extension-causes-high-cpu-load

Hi,

did you implement SSH connection tunneling, if yes how the URL connection should look like?
If not, could you implement it?

Best regards,

Eric