Executive brief
Coder Code Extension Marketplace is an open-source platform used to host and distribute VS Code extensions. A security flaw allows an attacker to upload a specially crafted extension file that can write files to any location on the server's filesystem. This could lead to a complete system takeover by overwriting critical system files or injecting malicious scripts into the server's operating environment.
Technical details
A Zip Slip (CWE-22) path traversal vulnerability exists in the ExtractZip function of coder/code-marketplace. The application fails to sanitize zip entry names before passing them to a callback that uses filepath.Join to construct output paths. Because filepath.Join resolves '..' components without verifying that the resulting path remains within the intended base directory, an attacker can provide a VSIX file with malicious path entries. This allows for arbitrary file writes outside the extension directory, potentially enabling remote code execution via cron injection, SSH key placement, or binary overwriting. The issue is fixed in version 2.4.2.
Affected products
- Coder code-marketplace <= 2.4.1
Timeline
- 2026-04-02: patched: Version 2.4.2 released
- 2026-04-02: advisory: GitHub Security Advisory GHSA-8x9r-hvwg-c55h published
- 2026-04-06: disclosed: CVE-2026-35454 published