Executive brief
Open VSX Registry, a service that provides extensions for code editors like VS Code and VSCodium, was found to have a security flaw in how it handles uploaded files. An attacker could upload a specially crafted file that, if viewed by a logged-in user, allows the attacker to hijack that user's account. This could lead to a supply chain attack where the attacker publishes malicious updates to popular software extensions, potentially infecting thousands of developers' computers.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Open VSX Registry's /vscode/unpkg/ endpoint. The server fails to implement a Content-Security-Policy (CSP), X-Content-Type-Options: nosniff, or Content-Disposition: attachment headers when serving files from uploaded VSIX packages. An attacker with a low-privileged publisher account can upload a VSIX containing a malicious HTML payload. When an authenticated user (such as a high-privilege publisher) views this file, the script executes in the context of the open-vsx.org origin. This allows for session token exfiltration, Personal Access Token (PAT) generation, and unauthorized publication of extension versions. The issue is fixed in version 1.0.2 by implementing strict HTTP security headers.
Affected products
- Eclipse Foundation Eclipse Open VSX 0.1.0 to 1.0.1
Timeline
- 2026-06-23: patched: Pull request 1922 merged to fix the issue.
- 2026-07-01: advisory: CVE-2026-13323 published.