Github Com Checkmarx Ast Cli
Monthly
Checkmarx ast-cli through 2.3.59 fetches the Vorpal ASCA real-time engine and SCA Resolver helper binaries from download.checkmarx.com during its auto-update flow and extracts and executes them without verifying a checksum, so an attacker who could substitute the served archive could get an arbitrary binary executed on developer machines and CI runners. Triggering the vulnerable path requires either a developer using the Checkmarx VSCode/JetBrains extension (which invokes ASCA) or someone running 'cx scan sca-realtime' on an affected version, and exploitation further requires control of the vendor's download endpoint or interception of the download - a high, attacker-uncontrolled barrier reflected in the elevated attack complexity. The vendor has released 2.3.60, which verifies the download against a published SHA-256 checksum before extraction; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), placing it in the this_month priority bucket.
Path traversal in Checkmarx ast-cli's tar extraction logic on Linux and macOS (versions before 2.3.51) allows a crafted archive containing absolute or '../' entries to write files outside the install directory, including executable files at arbitrary filesystem paths. The only path to exploitation described in the advisory is substituting the archive served at download.checkmarx.com that ast-cli fetches when installing the Vorpal ASCA real-time engine or the SCA Resolver, so the dominant precondition is control of that distribution artifact plus a victim running the install (user interaction required). Windows builds perform the path validation and are unaffected; no public exploit code was identified at time of analysis.
Checkmarx ast-cli through 2.3.59 fetches the Vorpal ASCA real-time engine and SCA Resolver helper binaries from download.checkmarx.com during its auto-update flow and extracts and executes them without verifying a checksum, so an attacker who could substitute the served archive could get an arbitrary binary executed on developer machines and CI runners. Triggering the vulnerable path requires either a developer using the Checkmarx VSCode/JetBrains extension (which invokes ASCA) or someone running 'cx scan sca-realtime' on an affected version, and exploitation further requires control of the vendor's download endpoint or interception of the download - a high, attacker-uncontrolled barrier reflected in the elevated attack complexity. The vendor has released 2.3.60, which verifies the download against a published SHA-256 checksum before extraction; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), placing it in the this_month priority bucket.
Path traversal in Checkmarx ast-cli's tar extraction logic on Linux and macOS (versions before 2.3.51) allows a crafted archive containing absolute or '../' entries to write files outside the install directory, including executable files at arbitrary filesystem paths. The only path to exploitation described in the advisory is substituting the archive served at download.checkmarx.com that ast-cli fetches when installing the Vorpal ASCA real-time engine or the SCA Resolver, so the dominant precondition is control of that distribution artifact plus a victim running the install (user interaction required). Windows builds perform the path validation and are unaffected; no public exploit code was identified at time of analysis.