What is the CVSS score of EUVD-2026-40945?

EUVD-2026-40945 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Eclipse Open VSX are affected by EUVD-2026-40945?

Eclipse Open VSX Registry (versions before 1.0.2) contains a stored XSS vulnerability in its extension upload mechanism that enables attackers to inject malicious code into the supply chain for VS…. A patch is available.

How to fix or mitigate EUVD-2026-40945?

Within 24 hours: Audit your organization's use of VS Code, VSCodium, Cursor, and Windsurf, and verify which systems pull extensions from open-vsx.org. Within 7 days: If you self-host Eclipse Open VSX Registry, upgrade to version 1.0.2 or later. Within 30 days: Review publisher activity logs and extension version histories on open-vsx.org during the vulnerable window (versions 0.1.0-1.0.1) for suspicious publishers or unexpected version modifications.

Eclipse Open VSX EUVD-2026-40945

| CVE-2026-13323 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 eclipse

GHSA-f3mc-x4vf-jrw2

XSS Red Hat Eclipse Open Vsx Eclipse Foundation

8.7

CVSS 3.1 · NVD

Severity by source

Vendor (eclipse) PRIMARY

MEDIUM

qualitative

NVD

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network-reachable, low-complexity stored XSS needing only a self-service publisher account (PR:L) and victim interaction (UI:R); executes in the trusted origin so S:C with high C/I, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (eclipse).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 21:40 vuln.today

v5 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 21:39 vuln.today

v4 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 21:38 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 06, 2026 - 21:37 vuln.today

Analysis Updated

Jul 06, 2026 - 21:37 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 20:37 vuln.today

cvss_changed

Severity Changed

Jul 06, 2026 - 20:37 NVD

MEDIUM HIGH

CVSS changed

Jul 06, 2026 - 20:37 NVD

4.1 (MEDIUM) 8.7 (HIGH)

Patch available

Jul 01, 2026 - 13:01 EUVD

Analysis Generated

Jul 01, 2026 - 12:21 vuln.today

DescriptionNVD

In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or Content-Disposition: attachment response header. An unauthenticated attacker can register a publisher account, upload a VSIX containing a crafted HTML payload, and induce an authenticated user to visit the resulting URL. The browser renders the file inline in the open-vsx.org origin context, enabling session token exfiltration, persistent Personal Access Token (PAT) generation, and unauthorized publication of malicious extension versions. Because Open VSX extensions are distributed to VS Code, VSCodium, Cursor, Windsurf, and compatible editors, a compromised extension update constitutes a supply chain attack against all downstream users.

AnalysisAI

Stored cross-site scripting in Eclipse Open VSX Registry (versions 0.1.0 through before 1.0.2) allows an attacker who self-registers a publisher account to upload a VSIX containing malicious HTML that the /vscode/unpkg/ endpoint serves inline as text/html within the open-vsx.org origin, with no Content-Security-Policy or Content-Disposition: attachment header. When a logged-in victim is lured to the resulting URL, the script runs in the registry's origin and can steal session tokens, mint Personal Access Tokens, and publish trojanized extension versions - turning a single XSS into a supply-chain compromise of VS Code, VSCodium, Cursor, and Windsurf users. No public exploit is identified at time of analysis and EPSS risk is low (0.17%), but the downstream blast radius is severe.

Technical ContextAI

Open VSX is Eclipse Foundation's open, vendor-neutral marketplace that replaces Microsoft's proprietary Visual Studio Marketplace for editors like VSCodium, Cursor, Windsurf, Gitpod, and Eclipse Theia. The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS: the VS Code compatibility adapter's asset/unpkg file-serving path returned publisher-controlled files using their intrinsic content type and inline disposition rather than forcing a safe download. The confirmed CPE is cpe:2.3:a:eclipse_foundation:eclipse_open_vsx. The upstream fix (PR #1922) reworks LocalVSCodeService/UpstreamVSCodeService to route asset responses through a centralized HttpHeadersUtil.createFileResponseHeaders helper (adding safe headers and treating files as downloads with null/derived filenames), and also bumps Apache Tika from 3.2.2 to 3.3.1 for more reliable content-type handling - indicating the root cause was trusting user-supplied file content types and serving them inline in the trusted origin.

RemediationAI

Vendor-released patch: upgrade Eclipse Open VSX to 1.0.2 or later, which is the fixed version per the EUVD range and the upstream fix in https://github.com/eclipse-openvsx/openvsx/pull/1922 (self-hosted operators should redeploy from the 1.0.2 release). Where an immediate upgrade is not possible, apply the same defenses the patch encodes: configure the reverse proxy or web layer to force Content-Disposition: attachment and a restrictive Content-Security-Policy (e.g. default-src 'none'; sandbox) on responses from the /vscode/unpkg/ and asset-serving endpoints so publisher-supplied HTML/SVG is downloaded rather than rendered inline - note this can break any legitimate inline preview of those assets. Additionally, tighten publisher self-registration or require review/verification before new publishers can upload, and rotate/scope-limit any PATs, accepting that stricter onboarding adds operator friction. Track the advisory at https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/485 and https://vuldb.com/vuln/375509.