Date: 2026-03-07 Scope: Source code (CWE analysis) + npm dependency tree (CVE analysis) Tools: npm audit, manual grep, static analysis

All findings are in transitive dependencies of @vscode/vsce (a devDependency used only at package-build time). None of these packages are bundled or shipped in the .vsix extension.

Mitigation: No action required for extension users. These vulnerabilities only affect the development build toolchain. To eliminate from audit output, run npm audit --omit=dev.

File: src/vscode/compiler.ts, src/core/flags.ts

Both use child_process.spawn / spawnSync with shell: false (default). Arguments are passed as a string array, never concatenated into a shell string. No interpolation into shell commands.

Status: Safe. No action required.

File: src/vscode/serverView.ts

The server console WebView appends log output using textContent (not innerHTML) for user-controlled data. The one use of innerHTML is for clearing: el.innerHTML = ''. No untrusted string is injected as HTML.

Status: Safe. No action required.

File: src/core/, src/vscode/

All file paths are constructed from workspace-root-relative settings values. No user input (e.g., HTTP request parameters) reaches fs.readFile or fs.writeFile. Include path resolution via resolveInclude() only resolves within configured include directories.

Status: Safe. No action required.

File: src/core/config.ts

The deepMerge function explicitly blocks prototype-polluting keys:

const forbidden = ['__proto__', 'constructor', 'prototype'];
if (forbidden.includes(key)) continue;

Status: Protected. No action required.

File: src/core/unusedAnalyzer.ts

Three locations constructed new RegExp(name) by directly interpolating a parsed identifier name without escaping special regex characters:

// Before fix (lines 61, 93, 138):
new RegExp(`\\b${keyword}\\s+${name}\\b`)
new RegExp(`\\bstock\\s+(?:[A-Za-z_]\\w*:)?\\s*(${name})\\s*\\(`)
new RegExp(`\\b(new|static|const)\\s+${name}\\b`)

Although Pawn identifiers are constrained to [A-Za-z_]\w* (no regex metacharacters in practice), a crafted source file could theoretically supply an identifier-like token through macro expansion or edge-case parsing, triggering catastrophic backtracking.

Fix applied: Added escapeRe() helper and applied it to all three interpolation sites:

function escapeRe(s: string): string {
  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
}

// After fix:
new RegExp(`\\b${escapeRe(keyword)}\\s+${escapeRe(name)}\\b`)
new RegExp(`\\bstock\\s+(?:[A-Za-z_]\\w*:)?\\s*(${escapeRe(name)})\\s*\\(`)
new RegExp(`\\b(new|static|const)\\s+${escapeRe(name)}\\b`)

CVSS v3.1 (hypothetical): 4.3 (Medium) — AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Status: Fixed in v2.1.

1. Pin @vscode/vsce devDependency to a version that resolves its transitive CVEs, or add overrides in package.json for the affected packages.
2. Consider adding a pre-publish npm audit --omit=dev --audit-level=high check to CI to catch future high/critical devDep chains early.
3. The escapeRe fix is already committed. No further remediation needed for CWE-400.