Checkmarx ast-cli EUVD-2026-108269

Exploitation requires the attacker to control the archive served at download.checkmarx.com (compromising or substituting that distribution artifact), and a victim on Linux or macOS running ast-cli version < 2.3.51 must trigger an install that extracts the tar - specifically the installation of the Vorpal ASCA real-time engine or the SCA Resolver. The malicious tar must contain absolute or '../' traversal entries. Limiting factors: only Linux/macOS builds are vulnerable (Windows builds perform the path validation and are not affected); exploitation depends on a user-initiated install action (UI:R); and the core barrier is the supply-chain precondition of controlling the served archive, which is a significant obstacle for most attackers. Fixed in 2.3.51; no workaround exists other than upgrading.

This is a medium-severity supply-chain weakness (vendor CVSS 6.4) whose real-world risk is heavily constrained by a single dominant precondition: the advisory states exploitation required substituting the archive served at download.checkmarx.com, meaning an attacker must already have compromised Checkmarx's official distribution server (or otherwise controlled that served archive). That gating condition - not the path-traversal bug itself - is what limits practical exploitation, and it is reflected in the vendor vector's AC:H and UI:R. The vendor vector also sets PR:H, but the described attack does not require the attacker to hold privileges on the victim host; the privilege barrier is really the server compromise, which CVSS 3.1 captures as attack complexity rather than PR - so PR:H appears overstated and is better read as PR:N/AC:H (noted in confidence_notes). No EPSS score, SSVC automatable/technical-impact metrics, or KEV listing were provided in the input, and there is no public exploit identified at time of analysis; the only references are the source repo and the GHSA advisory. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-not-urgent issue: genuine code-execution impact (arbitrary executable file write) but a high exploitation bar. Net: prioritize patching to 2.3.51 within normal cycles rather than as an emergency; the absence of KEV, the lack of a working public exploit, and the server-compromise precondient all point to low likelihood of widespread opportunistic exploitation.

An attacker who has compromised the download.checkmarx.com distribution server replaces the legitimate install archive with a malicious tar containing absolute or '../' traversal entries. When a developer or CI runner on Linux or macOS runs ast-cli (versions < 2.3.51) and it fetches and extracts the Vorpal ASCA real-time engine or SCA Resolver, the crafted entries write attacker-controlled executable files outside the intended install directory, enabling code execution. No public working exploit is identified at time of analysis; only the vendor advisory exists.