CVE-2021-28789: Apple-Swift-Format Project Apple-Swift-Format

High severity, CVSS 7.8. EPSS: 1.7% chance of exploitation in the next 30 days.

The unofficial apple/swift-format extension before 1.1.2 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted apple-swift-format.path configuration value that triggers execution upon opening the workspace.

Affected products

• Apple-Swift-Format Project Apple-Swift-Format: before 1.1.2 (fixed in 1.1.2)

Published 2021-03-18. Last modified 2026-06-17.