Open VSX Registry vulnerabilities

The VSIX publishing service limits the compressed file size (ovsx.publishing.max-content-size, 512 MB by default) but does not limit the decompressed entry size. WebResourceService opens the entry via ZipFile.getInputStream() and copies the decompressed stream without counting bytes, and the java.io.tmpdir cache is evicted by entry count (150), not size, allowing a publisher with their own namespace to fill the temp filesystem.

In Open VSX Registry before version 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without Content-Security-Policy or Content-Disposition: attachment headers. An unauthenticated attacker can register a publisher account, upload a VSIX containing a crafted HTML payload, and trick an authenticated user into visiting the resulting URL.

The Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, allowing the publication of a malicious extension with an SVG icon. This leads to stored XSS attacks when a user navigates directly to the icon URL.