CVE-2026-42212 Details

A vulnerability exists in the SolidCAM Postprocessor IDE extension for Visual Studio Code, specifically in versions 1.0.0 prior to 1.0.2. The issue arises when a .gpp file is opened, prompting the language server to parse a related .vmid file from the same directory. The VMID parser, in these vulnerable versions, used XDocument.Load without proper XmlReaderSettings, allowing for XML External Entity (XXE) attacks. A malicious .vmid file could exploit this by disclosing local files through external entity references, causing a denial-of-service by exhausting memory with recursive entity expansion, or disrupting service with oversized or deeply nested XML. This vulnerability is particularly concerning as it can be triggered by simply opening a .gpp file from an untrusted source, such as forums or shared drives.

Users should upgrade to SolidCAM Postprocessor IDE version 1.0.2 or later, which addresses this vulnerability by disabling DTD processing, preventing external entity references, and adding a file size cap. Instructions for updating can be found on the GitHub Releases page for this extension.