I found a remote code execution bug in VSCode that can be triggered from untrusted workspaces. Microsoft fixed it but marked it as moderate severity and ineligible under their bug bounty program.

1. Git

   1 308 54,433 10.0 C

   Git Source Code Mirror - This is a publish-only repository but pull requests can be turned into patches to the mailing list via GitGitGadget (https://gitgitgadget.github.io/). Please follow Documentation/SubmittingPatches procedure for any of your improvements.

   

2. CodeRabbit

   coderabbit.ai featured

   CodeRabbit: AI Code Reviews for Developers. Revolutionize your code reviews with AI. CodeRabbit offers PR summaries, code walkthroughs, 1-click suggestions, and AST-based analysis. Boost productivity and code quality across all major languages with each PR.

   

3. Visual Studio Code

   2 3,118 170,026 10.0 TypeScript

   Visual Studio Code

   

4. llvm-project

   3 401 32,001 10.0 LLVM

   The LLVM Project is a collection of modular and reusable compiler and toolchain technologies.

   

   You are mostly right, but the "remote" aspect comes from the fact that https://github.dev/ can open any random repository (e.g. go to this LLVM README file and then hit the "github.dev" in the dropdown menu for edit). Nothing gets downloaded to your computer and happens on the cloud. You are editing a remote repository on a remote computer.

5. dev

   4 33 1,311 0.0

   Discontinued Press the . key on any repo (by github)

   

   You are mostly right, but the "remote" aspect comes from the fact that https://github.dev/ can open any random repository (e.g. go to this LLVM README file and then hit the "github.dev" in the dropdown menu for edit). Nothing gets downloaded to your computer and happens on the cloud. You are editing a remote repository on a remote computer.

6. vscodium

   5 558 26,966 9.4 Shell

   binary releases of VS Code without MS branding/telemetry/licensing

   

   Why not use the version without any Microsoft branding?

7. ClearScript

   6 8 1,864 5.9 C#

   A library for adding scripting to .NET applications. Supports V8 (Windows, Linux, macOS) and JScript/VBScript (Windows).

   

   Microsoft makes ClearScript

8. quickjs

   7 75 9,060 9.1 C

   Public repository of the QuickJS Javascript Engine.

   

   There's QuickJS

9. InfluxDB

   influxdata.com featured

   InfluxDB high-performance time series database. Collect, organize, and act on massive volumes of high-resolution data to power real-time intelligent systems.

   

10. rhino

    8 15 4,321 9.5 JavaScript

    Rhino is an open-source implementation of JavaScript written entirely in Java

    

    Mozilla made Rhino

Suggest a related project