Code Extension Marketplace: Zip Slip Path Traversal

The core of this vulnerability lies in the ExtractZip function's handling of zip entry names. The function directly passes attacker-controlled zip entry names (zf.Name) to a callback function without proper sanitization or boundary checks. This allows an attacker to craft a VSIX file containing zip entries with malicious paths, such as those containing .. sequences. filepath.Join resolves these .. components, but it doesn't prevent the resulting path from escaping the base directory, enabling arbitrary file writes. Successful exploitation could allow an attacker to overwrite critical system files, inject malicious code into the application, or exfiltrate sensitive data. The potential impact is significant, as it could lead to complete system compromise.

Organizations utilizing github.com/coder/code-marketplace in their development environments, particularly those relying on VSIX file extensions for code or tool integration, are at risk. Environments with legacy configurations or those lacking robust input validation practices are especially vulnerable.

• linux / server:

find /opt/code-marketplace -name '*.zip' -exec grep -l '..\..' {} + | xargs ls -l

• generic web:

curl -I 'http://your-code-marketplace-url/extensions/malicious.vsix' # Check for unusual response headers or file access

1. 2026-04-04Disclosure

   disclosure

1. Réservé2026-04-02
2. Publiée2026-04-04
3. Modifiée2026-04-07
4. EPSS mis à jour2026-04-14

The primary mitigation is to upgrade to version 1.2.3-0.20260402184705-988440dee05f or later. If an immediate upgrade is not feasible, consider implementing a temporary workaround by validating the zip entry names before passing them to the callback function. This validation should ensure that the resulting file path remains within the designated extension directory. Additionally, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious zip file extensions or patterns indicative of path traversal attempts. After upgrading, confirm the fix by attempting to upload a VSIX file with a malicious path (e.g., ../../../../etc/passwd) and verifying that the file write is prevented.