CVE-2025-12999
CriticalCVSS 9.1Summary
A vulnerability in Open VSX allows an unauthenticated attacker to poison the per-extension metadata cache by supplying a crafted X-Forwarded-Host header, replacing download, signature, and public-key URLs with attacker-controlled ones. The cache keys do not include the host, so poisoned entries are served to all clients for the entry's lifetime (1 hour by default, cluster-wide with Redis).
Risk Assessment
An attacker can cause VS Code-compatible editors to fetch and install a malicious VSIX, leading to arbitrary code execution in development environments. Extension signing does not limit the impact because the attacker supplies the package, signature, and verification key.
Recommendation
Configure the reverse proxy to overwrite X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Prefix headers instead of relaying client values. Ensure the server is only reachable through the proxy, and flush caches after configuration changes to remove poisoned entries.
Related vulnerabilities
- CVE-2026-94101Critical
A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected function is vlan_load_form_uci in /usr/bin/routerd, where manipulation of the wan_num argument leads to buffer overflow. The attack can be initiated remotely and the exploit is publicly disclosed.
- CVE-2026-94100Critical
A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. The affected function is wan_config_set_vlan in /usr/bin/routerd, where manipulation of the vlan_wanX.ports argument leads to buffer overflow. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-94099Critical
A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. The issue affects the restore.cgi file in the Backup Restore component, where manipulation of the QUERY_STRING argument results in command injection. The attack can be carried out remotely and the exploit is publicly released.
- CVE-2026-94098Critical
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /www/cgi-bin/upgrade file in the Firmware Upgrade CGI Endpoint component, where manipulation of the QUERY_STRING argument leads to command injection. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-94097Critical
A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /www/cgi-bin/network_tools file in the CGI Diagnostic Endpoint component, where manipulation of the param/key/val arguments causes command injection. Remote exploitation is possible and the exploit has been publicly disclosed.
- CVE-2026-94096Critical
A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /usr/bin/network_tools file in the LAN IP Configuration Handler component, where manipulation of the ipv4 argument results in command injection. The attack may be launched remotely and the exploit has been made public.
- CVE-2026-94095Critical
A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /usr/bin/network_tools file in the Traceroute Diagnostic Feature component, where manipulation of the url argument leads to command injection. The attack may be initiated remotely and the exploit has been disclosed publicly.
- CVE-2026-94089Critical
A vulnerability was found in D-Link DIR-868L 2.01b05 in the strcpy function of the file /webfa_authentication.cgi in the Authentication Handler component. Manipulating the id/password arguments leads to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been publicly disclosed.
- CVE-2026-88857Critical
In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The saveWatermark() function copies an uploaded file to a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, content check, or filename sanitization. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.
- CVE-2026-88856Critical
In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The updateOSGallery() function, reached via task=update_osgallery, reads a JSON request body and calls the value of a method field as a live PHP function, passing the value of a package field as its single argument, with no allow-list or is_callable() check. Any function name compatible with a single argument is directly reachable, including system, exec, shell_exec, and passthru.
Original NVD description (English source)
UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back to the client-supplied Host header. Those responses are cached under keys that do not include the host (extension.json since 0.6.0, namespace.details.json since 0.9.0, sitemap since 0.14.5, latest.extension.version.vscode since 0.34.2). A single request carrying a forged header therefore places attacker-chosen URLs into an entry served to every other client for the lifetime of that entry — one hour by default, and cluster-wide where ovsx.redis.enabled is set. The VSIX download URL, its signature URL and the public key URL are all derived from the same base URL, so extension signing does not limit the impact: an attacker who poisons an entry supplies the package, the signature over it, and the key used to verify it. Exploitability depends on deployment topology. A server reachable directly by clients, or fronted by a proxy that relays the client's X-Forwarded-Host rather than overwriting it, is exploitable by an unauthenticated remote attacker. A proxy that overwrites the header is not. An unauthenticated attacker can poison Open VSX's per-extension metadata cache with attacker-controlled download, signature, and public-key URLs by supplying a crafted X-Forwarded-Host header, causing downstream VS Code-compatible editors to fetch and install a malicious VSIX. Workarounds (unpatched versions) 1. Configure the reverse proxy to set rather than relay X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix — note that nginx's $host is the client's Host header and is not a safe value. 2. Ensure the server is not reachable except through that proxy. 3. Flush the caches afterwards; poisoned entries survive the configuration change.