CVE-2021-30124

An attacker crafts a malicious workspace folder containing a `.vscode/settings.json` file that sets `phpmd.command` to an arbitrary command string. When the victim opens this folder in Visual Studio Code with the vulnerable extension installed, the extension reads the workspace setting and executes the attacker-controlled command, achieving remote code execution on the victim's machine. [ref_id=1]

The vulnerability exists in the `phpmd.command` configuration setting of the vscode-phpmd extension before version 1.3.0. The extension allowed this setting to be controlled through workspace-level settings, which an attacker could supply in a malicious workspace folder.

The patch disables the `phpmd.command` setting at the workspace level, restricting it to user or machine settings only. This prevents an attacker from injecting a malicious command via a workspace folder's settings. The commit message explicitly states that before version 1.3.0 it was possible to set `phpmd.command` through workspace settings, opening possibilities for a remote code execution attack. [ref_id=1]