Code Extension Marketplace: Zip Slip Path Traversal

The impact of this vulnerability is significant. An attacker can craft a malicious VSIX file that, when processed by coder/code-marketplace, will write files to arbitrary locations on the system. This could include overwriting critical system files, injecting malicious code into existing extensions, or gaining unauthorized access to sensitive data. The ability to write outside the designated extension directory bypasses security controls designed to isolate extensions and protect the underlying system. Successful exploitation could lead to complete system compromise, depending on the permissions of the process running coder/code-marketplace.

Organizations utilizing github.com/coder/code-marketplace in their development environments, particularly those relying on VSIX file extensions for code or tool integration, are at risk. Environments with legacy configurations or those lacking robust input validation practices are especially vulnerable.

• linux / server:

find /opt/code-marketplace -name '*.zip' -exec grep -l '..\..' {} + | xargs ls -l

• generic web:

curl -I 'http://your-code-marketplace-url/extensions/malicious.vsix' # Check for unusual response headers or file access

1. 2026-04-04Disclosure

   disclosure

1. Reserviert2026-04-02
2. Veröffentlicht2026-04-04
3. Geändert2026-04-07
4. EPSS aktualisiert2026-04-14

The primary mitigation is to immediately upgrade coder/code-marketplace to version 1.2.3-0.20260402184705-988440dee05f or later. If upgrading is not immediately feasible, consider implementing stricter file access controls to limit the write permissions of the process running coder/code-marketplace. Additionally, implement input validation and sanitization on all uploaded VSIX files to prevent the inclusion of malicious paths. While a direct WAF rule is unlikely, a proxy could be configured to inspect VSIX file contents for suspicious path patterns before processing. After upgrading, confirm the fix by attempting to upload a test VSIX file containing a path traversal payload (e.g., ../../../../etc/passwd) and verifying that the file is not written to the intended location.