CVE-2026-42213
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
The SolidCAM-GPPL-IDE extension from version 1.0.0 to before 1.0.2 improperly handles the inc "filename" directive in GPPL postprocessor files, resolving arbitrary paths (absolute, relative with parent-directory segments, UNC, and subfolders) into clickable links and calling File.Exists. This results in information disclosure via File.Exists probing and NTLM hash leak via UNC path probing. The issue is patched in version 1.0.2.
Risk Assessment
An attacker could use the extension to probe file existence on the system and leak NTLM hashes, potentially enabling further attacks on the organization's infrastructure. The risk affects VS Code users with the extension installed who open untrusted postprocessor files.
Recommendation
Upgrade the SolidCAM-GPPL-IDE extension to version 1.0.2 or later. Avoid opening untrusted GPPL postprocessor files in VS Code with the extension installed.
Other vulnerabilities in SolidCAM-GPPL-IDE
Original NVD description (English source)
SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, the inc "filename" directive in GPPL postprocessor files is resolved by GpplDocumentLinkHandler into a clickable link (VS Code textDocument/documentLink). The handler accepted arbitrary paths — absolute, relative with parent-directory segments (..\..\..\), UNC (\\server\share\), and arbitrary subfolders — and called File.Exists on each to decide whether to render the link. Two distinct attack surfaces resulted: information disclosure via File.Exists probing and NTLM hash leak via UNC path probing. This issue has been patched in version 1.0.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS