# CVE-2026-13323: Eclipse Open VSX stored XSS in unpkg endpoint

Source: https://junglewise.ai/threats/cve-2026-13323-eclipse-open-vsx-stored-xss-in-unpkg-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-13323 · Severity: medium · CVSS 4.1 · Published 2026-07-01

Open VSX Registry, a service that provides extensions for code editors like VS Code and VSCodium, was found to have a security flaw in how it handles uploaded files. An attacker could upload a specially crafted file that, if viewed by a logged-in user, allows the attacker to hijack that user's account. This could lead to a supply chain attack where the attacker publishes malicious updates to popular software extensions, potentially infecting thousands of developers' computers.

Technologies: [Eclipse Foundation Open VSX](https://junglewise.ai/threats/technologies/open-vsx). Vendors: [Eclipse Foundation](https://junglewise.ai/threats/vendors/eclipse-foundation).

## Quick answers

**Is CVE-2026-13323 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13323 being exploited in the wild.

**How severe is CVE-2026-13323?** Medium severity, with a CVSS score of 4.1, published 1 July 2026.

**Which products and versions are affected?** Eclipse Foundation Open VSX 0.1.0 to 1.0.1.

**Is there a fix for CVE-2026-13323?** A patch was published on 2026-06-23: Pull request 1922 merged to fix the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13323 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-13323?** Check whether you run Eclipse Foundation Open VSX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Open VSX Registry's /vscode/unpkg/ endpoint. The server fails to implement a Content-Security-Policy (CSP), X-Content-Type-Options: nosniff, or Content-Disposition: attachment headers when serving files from uploaded VSIX packages. An attacker with a low-privileged publisher account can upload a VSIX containing a malicious HTML payload. When an authenticated user (such as a high-privilege publisher) views this file, the script executes in the context of the open-vsx.org origin. This allows for session token exfiltration, Personal Access Token (PAT) generation, and unauthorized publication of extension versions. The issue is fixed in version 1.0.2 by implementing strict HTTP security headers.

## Affected products

- Eclipse Foundation Eclipse Open VSX 0.1.0 to 1.0.1

## Timeline

- 2026-06-23: patched: Pull request 1922 merged to fix the issue.
- 2026-07-01: advisory: CVE-2026-13323 published.

## References

- [https://github.com/eclipse-openvsx/openvsx/pull/1922](https://github.com/eclipse-openvsx/openvsx/pull/1922)
- [https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/485](https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/485)

## Related threats

- [Open VSX CORS misconfiguration with credential reflection](https://junglewise.ai/threats/cve-2026-90882-the-open-vsx-org-deployment-returned-access-control-allow-origin)
- [Eclipse Open VSX stored XSS in extension icons](https://junglewise.ai/threats/cve-2026-4983-eclipse-open-vsx-stored-xss-in-extension-icons)