DevToys Path Traversal (“Zip Slip”) Vulnerability in DevToys Extension Installation

The core of this vulnerability lies in DevToys' extension installation process. When handling NUPKG archives (extension packages), the application fails to adequately validate file paths within these archives. An attacker can exploit this by embedding specially crafted file entries, such as ../../…/target-file, within a malicious extension package. This manipulation tricks the extraction process into writing files to locations outside the intended extensions directory. Consequently, an attacker can overwrite critical system files or configuration files with the privileges of the DevToys process, potentially leading to complete system compromise. The impact is significant, as it allows for arbitrary file overwrites, which can be leveraged for privilege escalation or to install malicious software.

Developers who utilize DevToys, particularly those who routinely install extensions from various sources, are at heightened risk. Users who have not implemented robust security practices, such as disabling extension installation from untrusted sources, are also more vulnerable. Shared development environments or systems where multiple developers share the same DevToys installation could amplify the impact of a successful exploitation.

• windows / supply-chain: Monitor for unusual file creation activity within the DevToys installation directory (e.g., using Process Monitor). Check Autoruns for suspicious entries related to DevToys extensions.

Get-ChildItem -Path "C:\Program Files\DevToys\Extensions" -Recurse -Force | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} | Sort-Object LastWriteTime

• generic web: While not directly applicable to DevToys, monitor network traffic for attempts to access or download DevToys extension packages from untrusted sources.

1. 2026-01-10Disclosure

   disclosure

1. Reserviert2026-01-08
2. Veröffentlicht2026-01-10
3. Geändert2026-01-12
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-22685 is to upgrade DevToys to version 2.0.9.0 or later, which contains the necessary fix. If an immediate upgrade is not feasible due to compatibility issues or testing requirements, consider isolating DevToys from untrusted networks and disabling the installation of extensions from unknown sources. While a direct WAF rule is unlikely to be effective, monitoring for unusual file creation activity within the DevToys extensions directory could provide early warning signs. After upgrading, verify the fix by attempting to install a known malicious extension package (in a controlled environment) and confirming that the file extraction process is properly restricted.