CVE-2026-22685: Path Traversal in DevToys

The core of this vulnerability lies in DevToys’ extension installation process. When handling NUPKG archive files, the application fails to adequately validate file paths within the archive. An attacker can exploit this by including specially crafted file entries, such as ../../…/target-file, within a malicious extension package. This bypasses the intended file extraction directory, allowing the attacker to write files to arbitrary locations on the user’s system. The potential impact is significant, as an attacker could overwrite critical system files, inject malicious code, or gain persistent access to the affected machine, effectively compromising the user’s environment. This is particularly concerning given DevToys' role as a developer tool, potentially granting access to sensitive project files and credentials.

1. Reserved2026-01-08
2. Published2026-01-10
3. Modified2026-01-12
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-22685 is to immediately upgrade DevToys to version 2.0.9.0 or later, which contains the necessary fix. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider isolating DevToys from untrusted networks and disabling the installation of extensions from unknown sources. While a direct WAF rule is unlikely, monitoring for unusual file creation activity within the DevToys installation directory could provide an early warning sign. After upgrading, verify the fix by attempting to install a known malicious extension package (in a controlled environment) and confirming that file extraction is restricted to the intended extensions directory.