Golan Myers

**Name of the Vulnerable Software and Affected Versions** Open VSX Registry versions prior to 1.0.2 **Description** The '/vscode/unpkg/' endpoint serves user-supplied HTML files with a `text/html` Content-Type and lacks a Content-Security-Policy or `Content-Disposition: attachment` response header. This allows an unauthenticated attacker to register a publisher account and upload a VSIX file containing a crafted HTML payload. If an authenticated user is induced to visit the resulting URL, the browser renders the file inline within the open-vsx.org origin context. This can lead to session token exfiltration, the generation of persistent Personal Access Tokens (PAT), and the unauthorized publication of malicious extension versions. Since extensions are distributed to editors such as VS Code, VSCodium, Cursor, and Windsurf, this issue could facilitate a supply chain attack against downstream users. **Recommendations** Update Open VSX Registry to version 1.0.2 or later. Restrict access to the '/vscode/unpkg/' endpoint as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** Open VSX Registry (affected versions not specified) **Description** The software fails to sanitize SVG files uploaded as extension icons before storage and serves them with the 'Content-Type: image/svg+xml' header without security headers like 'Content-Security-Policy' or 'Content-Disposition: attachment'. This allows an attacker to publish an extension with a malicious SVG icon, leading to stored cross-site scripting (XSS)—a flaw where malicious scripts are permanently stored on the server and executed in the victim's browser—when a user visits the icon URL. In deployments using local storage, script execution occurs within the application origin, potentially enabling session hijacking, authentication token theft, and unauthorized extension publishing. In deployments using external storage, such as an S3-backed CDN, execution is limited to the storage origin, which may still allow phishing and credential harvesting. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.