CVE-2021-28790: Swiftlint Project Swiftlint

High severity, CVSS 7.8. EPSS: 1.7% chance of exploitation in the next 30 days.

The unofficial SwiftLint extension before 1.4.5 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted swiftlint.path configuration value that triggers execution upon opening the workspace.

Affected products

• Swiftlint Project Swiftlint: before 1.4.5 (fixed in 1.4.5)

Published 2021-03-18. Last modified 2026-06-17.