EUVD-2026-38424
GHSA-xpqg-5hj3-ggmh
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L confirmed as extension publishing requires account registration; UI:R because direct icon URL navigation is the trigger; S:C captures cross-origin impact on local-storage deployments; no availability impact.
Primary rating from Vendor (eclipse).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security headers such as Content-Security-Policy or Content-Disposition: attachment. This allows an attacker to publish an extension with a malicious SVG icon and achieve stored cross-site scripting (XSS) when a user navigates directly to the icon URL.
On deployments using local storage, script execution occurs within the Open VSX application origin, enabling session hijacking, authentication token theft, and unauthorized extension publishing. On deployments backed by external storage (such as open-vsx.org with an S3-backed CDN), execution is confined to the storage origin, reducing impact but still permitting phishing attacks and credential harvesting through attacker-crafted pages.
AnalysisAI
Stored XSS in Eclipse Open VSX Registry allows authenticated extension publishers to embed malicious JavaScript inside SVG files uploaded as extension icons, which are stored and re-served without sanitization or protective headers. On local-storage deployments, script execution occurs within the Open VSX application origin, enabling session hijacking, authentication token theft, and unauthorized extension publishing on behalf of victims. On CDN-backed deployments (such as open-vsx.org using S3), scope is reduced to the storage origin - still usable for phishing and credential harvesting. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV.
Technical ContextAI
SVG (Scalable Vector Graphics) is an XML-based image format that natively supports embedded JavaScript via event handlers (e.g., onload, onclick) and script elements. When a server stores SVG files without sanitization and serves them with Content-Type: image/svg+xml rather than forcing a download via Content-Disposition: attachment, browsers render the SVG as an active document and execute embedded scripts. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant, compounded by the absence of mitigating response headers such as Content-Security-Policy. The affected product is identified in CPE as cpe:2.3:a:eclipse_foundation:eclipse_open_vsx:*:*:*:*:*:*:*:*, covering Eclipse Open VSX versions 0.1.0 through pre-0.34.1. Open VSX is an open-source extension registry compatible with VS Code-derived editors (VSCodium, Eclipse Theia, Gitpod), meaning self-hosted deployments vary widely in their storage backend configuration.
RemediationAI
Upgrade Eclipse Open VSX to version 0.34.1 or later, which is confirmed as the patched release per EUVD affected-version data. The vendor patch is available per the eclipse reporter and referenced via the Eclipse security advisory at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/91. For operators unable to patch immediately, two compensating controls apply: first, configure the web server or CDN to add a Content-Security-Policy: default-src 'none' response header specifically on icon/asset serving paths - this blocks inline script execution in SVG files at the browser level, though it may also affect legitimate SVG animations; second, override the Content-Type for uploaded SVG assets to serve them as Content-Disposition: attachment with MIME type application/octet-stream, forcing download rather than inline rendering - this breaks icon display in the UI as a trade-off. Neither workaround substitutes for patching; both require infrastructure-level configuration changes and should be tested for UI regressions before deployment.
More in Eclipse Open Vsx
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today