CVE-2026-35454
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Code Extension Marketplace prior to version 2.4.2 has a Zip Slip vulnerability allowing a malicious VSIX file to write arbitrary files outside the extension directory.
Risk Assessment
An attacker can overwrite arbitrary files on the system, potentially leading to remote code execution or other severe impacts.
Recommendation
Update Code Extension Marketplace to version 2.4.2 or later.
Original NVD description (English source)
The Code Extension Marketplace is an open-source alternative to the VS Code Marketplace. Prior to 2.4.2, Zip Slip vulnerability in coder/code-marketplace allowed a malicious VSIX file to write arbitrary files outside the extension directory. ExtractZip passed raw zip entry names to a callback that wrote files via filepath.Join with no boundary check; filepath.Join resolved .. components but did not prevent the result from escaping the base path. This vulnerability is fixed in 2.4.2.