# CVE-2026-4983: Eclipse Open VSX stored XSS in extension icons

Source: https://junglewise.ai/threats/cve-2026-4983-eclipse-open-vsx-stored-xss-in-extension-icons  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-4983 · Severity: medium · CVSS 4.1 · Published 2026-06-23

Eclipse Open VSX is an open-source registry for VS Code extensions. A vulnerability allows attackers to upload malicious extension icons that can execute scripts in a user's browser. Depending on how the registry is hosted, this could lead to session hijacking, theft of authentication tokens, or phishing attacks against developers using the platform.

Technologies: [Eclipse Foundation Open VSX](https://junglewise.ai/threats/technologies/open-vsx). Vendors: [Eclipse Foundation](https://junglewise.ai/threats/vendors/eclipse-foundation).

## Quick answers

**Is CVE-2026-4983 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4983 being exploited in the wild.

**How severe is CVE-2026-4983?** Medium severity, with a CVSS score of 4.1, published 23 June 2026.

**Which products and versions are affected?** Eclipse Foundation Open VSX 0.1.0 to 0.34.1.

**Is there a fix for CVE-2026-4983?** A patch was published on 2026-06-23: Fixed in version 0.34.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4983 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-4983?** Check whether you run Eclipse Foundation Open VSX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Eclipse Open VSX due to improper neutralization of SVG files uploaded as extension icons. The application fails to sanitize these files and serves them with the 'image/svg+xml' content type without protective security headers like Content-Security-Policy or Content-Disposition: attachment. An attacker with extension publishing privileges can upload a malicious SVG containing embedded scripts. When a victim navigates directly to the icon's URL, the script executes. In local storage configurations, this occurs within the application's origin, potentially allowing for session hijacking and unauthorized publishing; in CDN-backed configurations, the impact is limited to the storage origin. The issue is fixed in version 0.34.1 by rejecting SVG icons by default.

## Affected products

- Eclipse Foundation Eclipse Open VSX 0.1.0 to 0.34.1

## Timeline

- 2026-06-23: disclosed
- 2026-06-23: advisory
- 2026-06-23: patched: Fixed in version 0.34.1

## References

- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/91](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/91)

## Related threats

- [Open VSX CORS misconfiguration with credential reflection](https://junglewise.ai/threats/cve-2026-90882-the-open-vsx-org-deployment-returned-access-control-allow-origin)
- [Eclipse Open VSX stored XSS in unpkg endpoint](https://junglewise.ai/threats/cve-2026-13323-eclipse-open-vsx-stored-xss-in-unpkg-endpoint)