vscode-slnx-sqlite-disclosure: Visual Studio Code - Slnx.SQLite File Disclosure

2026-01-08 Visual Studio Code PoC Public

Description

Visual Studio Code and Visual Studio may create slnx.sqlite database files that contain solution metadata, project information, and potentially sensitive configuration data. If these files are accessible on a web server, they can expose internal project structure and development environment details.

PoC

id: vscode-slnx-sqlite-disclosure

info:
  name: Visual Studio Code - Slnx.SQLite File Disclosure
  author: ritikchaddha
  severity: high
  description: |
    Visual Studio Code and Visual Studio may create slnx.sqlite database files that contain solution metadata, project information, and potentially sensitive configuration data. If these files are accessible on a web server, they can expose internal project structure and development environment details.
  metadata:
    max-request: 2
    verified: true
    fofa-query: title="Visual Studio Code"
  tags: vscode,visual-studio,sqlite,disclosure,exposure,file,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/slnx.sqlite"
      - "{{BaseURL}}/.vs/slnx.sqlite"

    redirects: true
    stop-at-first-match: false

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "SQLite format", "TABLE", "UPDATE")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a00473045022005a3ef8f586cb786c202b7c656dbd985cf36148677b34d7cc2705017fc1ae46c0221008eb29cc969075ee70ab1f82c13904c6683a311ee90235dfdf0a6ed4db6ef9229:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/vscode-slnx-sqlite-disclosure.yaml

References

Related Vulnerabilities