Eclipse Open Vsx
Monthly
Stored cross-site scripting in Eclipse Open VSX Registry (versions 0.1.0 through before 1.0.2) allows an attacker who self-registers a publisher account to upload a VSIX containing malicious HTML that the /vscode/unpkg/ endpoint serves inline as text/html within the open-vsx.org origin, with no Content-Security-Policy or Content-Disposition: attachment header. When a logged-in victim is lured to the resulting URL, the script runs in the registry's origin and can steal session tokens, mint Personal Access Tokens, and publish trojanized extension versions - turning a single XSS into a supply-chain compromise of VS Code, VSCodium, Cursor, and Windsurf users. No public exploit is identified at time of analysis and EPSS risk is low (0.17%), but the downstream blast radius is severe.
Stored XSS in Eclipse Open VSX Registry allows authenticated extension publishers to embed malicious JavaScript inside SVG files uploaded as extension icons, which are stored and re-served without sanitization or protective headers. On local-storage deployments, script execution occurs within the Open VSX application origin, enabling session hijacking, authentication token theft, and unauthorized extension publishing on behalf of victims. On CDN-backed deployments (such as open-vsx.org using S3), scope is reduced to the storage origin - still usable for phishing and credential harvesting. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV.
Stored cross-site scripting in Eclipse Open VSX Registry (versions 0.1.0 through before 1.0.2) allows an attacker who self-registers a publisher account to upload a VSIX containing malicious HTML that the /vscode/unpkg/ endpoint serves inline as text/html within the open-vsx.org origin, with no Content-Security-Policy or Content-Disposition: attachment header. When a logged-in victim is lured to the resulting URL, the script runs in the registry's origin and can steal session tokens, mint Personal Access Tokens, and publish trojanized extension versions - turning a single XSS into a supply-chain compromise of VS Code, VSCodium, Cursor, and Windsurf users. No public exploit is identified at time of analysis and EPSS risk is low (0.17%), but the downstream blast radius is severe.
Stored XSS in Eclipse Open VSX Registry allows authenticated extension publishers to embed malicious JavaScript inside SVG files uploaded as extension icons, which are stored and re-served without sanitization or protective headers. On local-storage deployments, script execution occurs within the Open VSX application origin, enabling session hijacking, authentication token theft, and unauthorized extension publishing on behalf of victims. On CDN-backed deployments (such as open-vsx.org using S3), scope is reduced to the storage origin - still usable for phishing and credential harvesting. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV.