CVE-2026-35454: Path Traversal in code-marketplace

The core of this vulnerability lies in the ExtractZip function's handling of zip entry names. The function directly passes attacker-controlled zip entry names (zf.Name) to a callback function without proper sanitization or boundary checks. This allows an attacker to craft a VSIX file containing zip entries with malicious paths, such as those containing .. sequences. filepath.Join resolves these .. components, but it doesn't prevent the resulting path from escaping the base directory, enabling arbitrary file writes. Successful exploitation could allow an attacker to overwrite critical system files, inject malicious code into the application, or exfiltrate sensitive data. The potential impact is significant, as it could lead to complete system compromise.

1. Reserved2026-04-02
2. Published2026-04-04
3. Modified2026-04-07
4. EPSS updated2026-04-14

The primary mitigation is to upgrade to version 1.2.3-0.20260402184705-988440dee05f or later. If an immediate upgrade is not feasible, consider implementing a temporary workaround by validating the zip entry names before passing them to the callback function. This validation should ensure that the resulting file path remains within the designated extension directory. Additionally, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious zip file extensions or patterns indicative of path traversal attempts. After upgrading, confirm the fix by attempting to upload a VSIX file with a malicious path (e.g., ../../../../etc/passwd) and verifying that the file write is prevented.