Repository navigation
code version instead of code-server version stored in package.json file causing false positive Critical CVE detection #7071
Description
Is there an existing issue for this?
- I have searched the existing issues
OS/Web Information
Local, remote OS: Ubuntu 22.04
Remote Architecture: amd64
$ code-server --version
4.95.1 344df3875fee5979b5fda0c6bf00778d0ef1be48 with Code 1.95.1
Steps to Reproduce
- Having installed latest
code-servercheck its version using two methods:
a) the --version switch:
$ code-server --version
4.95.1 344df3875fee5979b5fda0c6bf00778d0ef1be48 with Code 1.95.1
versus:
b) the version stored in package.json:
$ cat /usr/lib/code-server/lib/vscode/package.json
{
"name": "code-server",
"version": "1.95.1",
"private": true,
"dependencies": {
"@microsoft/1ds-core-js": "^3.2.13",
"@microsoft/1ds-post-js": "^3.2.13",
"@parcel/watcher": "2.1.0",
"@vscode/deviceid": "^0.1.1",
"@vscode/iconv-lite-umd": "0.7.0",
"@vscode/proxy-agent": "^0.22.0",
"@vscode/ripgrep": "^1.15.9",
"@vscode/spdlog": "^0.15.0",
"@vscode/tree-sitter-wasm": "^0.0.4",
"@vscode/vscode-languagedetection": "1.0.21",
"@vscode/windows-process-tree": "^0.6.0",
"@vscode/windows-registry": "^1.1.0",
"@xterm/addon-clipboard": "^0.2.0-beta.48",
"@xterm/addon-image": "^0.9.0-beta.65",
"@xterm/addon-search": "^0.16.0-beta.65",
"@xterm/addon-serialize": "^0.14.0-beta.65",
"@xterm/addon-unicode11": "^0.9.0-beta.65",
"@xterm/addon-webgl": "^0.19.0-beta.65",
"@xterm/headless": "^5.6.0-beta.65",
"@xterm/xterm": "^5.6.0-beta.65",
"cookie": "^0.7.0",
"http-proxy-agent": "^7.0.0",
"https-proxy-agent": "^7.0.2",
"jschardet": "3.1.4",
"kerberos": "2.1.1",
"minimist": "^1.2.6",
"native-watchdog": "^1.4.1",
"node-pty": "^1.1.0-beta22",
"tas-client-umd": "0.2.0",
"vscode-oniguruma": "1.7.0",
"vscode-regexpp": "^3.1.0",
"vscode-textmate": "9.1.0",
"yauzl": "^3.0.0",
"yazl": "^2.4.3"
},
"overrides": {
"node-gyp-build": "4.8.1",
"kerberos@2.1.1": {
"node-addon-api": "7.1.0"
},
"@parcel/watcher@2.1.0": {
"node-addon-api": "7.1.0"
}
},
"type": "module"
}
- Run a vulnerability scanner such as Anchore Grype and see this false positive:
Package Version_Installed Vulnerability_ID .Severity Locations_RealPath
code-server 1.95.1 GHSA-frjg-g767-7363 Critical /usr/lib/code-server/lib/vscode/package.json
Expected
$ cat /usr/lib/code-server/lib/vscode/package.json
{
"name": "code-server",
"version": "4.95.1",
[..]
Actual
$ cat /usr/lib/code-server/lib/vscode/package.json
{
"name": "code-server",
"version": "1.95.1",
[..]
Logs
No response
Screenshot/Video
No response
Does this bug reproduce in native VS Code?
This cannot be tested in native VS Code
Does this bug reproduce in GitHub Codespaces?
Yes, this is also broken in GitHub Codespaces
Are you accessing code-server over a secure context?
- I am using a secure context.
Notes
No response
Activity
code-asher commentedon Nov 8, 2024
Hmm this is maybe tricky. The version number is accurate because it is meant to be the version of VS Code, which is 1.95.1.
But maybe we should change the
nametocode-ossor something like that.mirekphd commentedon Nov 9, 2024
There are two app names and two versions here, so the full info would be two key:value pairs... or at least a matching pair :) Now we have a key from one pair and a value from another...
code-asher commentedon Nov 12, 2024
We have two
package.jsonfiles, one in the root and one inlib/vscode, the root one iscode-serverand thelib/vscodeone iscode-oss, which I think makes sense because architecturally they are implemented as separate applications and are separate codebases.delsner commentedon Apr 9, 2025
Any updates on this? What exactly would be the problem with changing the
namein/usr/lib/code-server/lib/vscode/package.jsonfromcode-servertocode-oss?code-asher commentedon Apr 10, 2025
No problems with that change as far as I know, it just has not been done yet. I am not sure where it actually gets set, so it is an open question whether there is a line we should change, or if we should just set it again after building.
RubenAtBinx commentedon Jul 25, 2025
I also run into this same issue and it is blocking for production deployment. What I noticed is that when I follow the breadcrumbs I end up in the
microsoft/vscoderepository. The package.json there has the following lines:and when I check in the coder repository it says:
This looks like a sort of merge between the files, where the name is taken from one package.json file and the version from the other. This ends up as being interpreted with the incorrect version.
Any idea when this will be picked up?
code-asher commentedon Jul 29, 2025
Yeah somewhere along the line
code-oss-devbecomescode-serverbut I am not sure where it happens. It is probably sufficient to just change it after we finish building as part ofbuild-release.sh, although there may also be a variable to control the name, not sure.I am not currently planning on picking this up, but happy to merge a PR if someone figures it out.
Fix false positive CVE alerts by setting package name to code-oss-dev (…