CVE-2021-28791: Swiftformat Project Swiftformat

High severity, CVSS 7.8. EPSS: 1.6% chance of exploitation in the next 30 days.

The unofficial SwiftFormat extension before 1.3.7 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted swiftformat.path configuration value that triggers execution upon opening the workspace.

Affected products

• Swiftformat Project Swiftformat: before 1.3.7 (fixed in 1.3.7)

Published 2021-03-18. Last modified 2026-06-17.