Checkmarx ast-cli EUVD-2026-108271

Two concrete conditions must both hold. First, the attacker must gain control of the archive served from 'download.checkmarx.com' - either by compromising that server/CDN or by man-in-the-middling the download - because ast-cli (<= 2.3.59) fetches and extracts the Vorpal ASCA engine and SCA Resolver without verifying a checksum (CWE-353). Second, a victim must trigger the auto-update download: a developer running the Checkmarx VSCode/JetBrains extension (which invokes ASCA) or running 'cx scan sca-realtime' on an affected version. Limiting factors that sharply reduce realistic risk: exploitation depends entirely on compromising the vendor's own distribution endpoint (a high, attacker-uncontrolled barrier), it requires user/CI action to invoke the scan, and only versions <= 2.3.59 are affected - 2.3.60 adds published SHA-256 verification before extraction.

This is a high-impact-but-low-probability issue whose raw CVSS 6.4 (medium) overstates practical risk in one direction and the vector mislabels the barrier in another. The impact metrics (C:H/I:H/A:H) are justified because successful exploitation yields arbitrary code execution on a developer machine or CI runner. However, the exploitation precondition is severe: the attacker must compromise Checkmarx's own download infrastructure ('download.checkmarx.com') or successfully MITM the download, which is a well-defended, high-value target - this is what drives AC:H and matches the CWE-353 missing-integrity-check root cause. No EPSS score is provided in the input, there is no CISA KEV listing, and no PoC or exploit reference is present (the only references are the project repo and the GHSA advisory), so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' i.e. patch on a normal cadence rather than an emergency. One signal conflict to flag: the supplied CVSS vector uses PR:H, but the real barrier is not privileges on the victim host - it is control of the vendor's served archive, which is better modeled as attack complexity; verify metric intent with the vendor. Net: real but conditional, bounded by a supply-chain compromise that most threat actors cannot achieve, so it is a scheduled-patch priority, not a drop-everything one.

An attacker who has compromised 'download.checkmarx.com' (or can MITM the TLS download) replaces the served Vorpal ASCA / SCA Resolver archive with one containing a malicious binary. The next time a developer uses the Checkmarx VSCode/JetBrains extension or runs 'cx scan sca-realtime' on an affected ast-cli (<= 2.3.59), the auto-update flow downloads, extracts, and executes the attacker's binary without any checksum verification. No public exploit code or PoC reference is present in the supplied data.