Executive brief
Open VSX, an extension marketplace used by VS Code and compatible editors, builds download URLs for extensions from untrusted proxy headers without validation. An attacker can poison the cached metadata to redirect users to malicious extension packages, causing installations of trojaned software across all users for up to an hour.
Technical details
UrlUtil.getBaseUrl constructs absolute URLs for extension downloads, signatures, and keys from X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Prefix headers without validating the proxy's trustworthiness. Response metadata (extension.json, namespace.details.json, sitemap, latest.extension.version.vscode) is cached with keys that exclude the host, so a single poisoned request affects all clients cluster-wide. An unauthenticated remote attacker can inject malicious URLs if the server is directly reachable or behind a proxy that relays client headers; exploitation requires no authentication or user interaction beyond normal extension installation.
Affected products
- Open VSX Open VSX 0.6.0 and later
Timeline
- 2025-09-21: disclosed