CVE-2026-13323
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In Open VSX Registry before version 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without Content-Security-Policy or Content-Disposition: attachment headers. An unauthenticated attacker can register a publisher account, upload a VSIX containing a crafted HTML payload, and trick an authenticated user into visiting the resulting URL.
Risk Assessment
The risk includes session token exfiltration, persistent Personal Access Token (PAT) generation, and unauthorized publication of malicious extension versions. Since Open VSX extensions are distributed to editors like VS Code, VSCodium, Cursor, and Windsurf, a compromised extension update constitutes a supply chain attack against all downstream users.
Recommendation
Immediately upgrade Open VSX Registry to version 1.0.2 or later. As a temporary workaround, disable the /vscode/unpkg/ endpoint or add appropriate CSP and Content-Disposition headers.
Other vulnerabilities in Open VSX Registry
See all- CVE-2026-89321Medium
The VSIX publishing service limits the compressed file size (ovsx.publishing.max-content-size, 512 MB by default) but does not limit the decompressed entry size. WebResourceService opens the entry via ZipFile.getInputStream() and copies the decompressed stream without counting bytes, and the java.io.tmpdir cache is evicted by entry count (150), not size, allowing a publisher with their own namespace to fill the temp filesystem.
- CVE-2026-4983Medium
The Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, allowing the publication of a malicious extension with an SVG icon. This leads to stored XSS attacks when a user navigates directly to the icon URL.
Original NVD description (English source)
In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or Content-Disposition: attachment response header. An unauthenticated attacker can register a publisher account, upload a VSIX containing a crafted HTML payload, and induce an authenticated user to visit the resulting URL. The browser renders the file inline in the open-vsx.org origin context, enabling session token exfiltration, persistent Personal Access Token (PAT) generation, and unauthorized publication of malicious extension versions. Because Open VSX extensions are distributed to VS Code, VSCodium, Cursor, Windsurf, and compatible editors, a compromised extension update constitutes a supply chain attack against all downstream users.