Tvrinssen

**Name of the Vulnerable Software and Affected Versions** Open VSX (affected versions not specified) **Description** An unauthenticated remote attacker can poison the per-extension metadata cache by supplying crafted `X-Forwarded-Host`, `X-Forwarded-Proto`, and `X-Forwarded-Prefix` request headers. The `UrlUtil.getBaseUrl()` function builds absolute URLs for download links, icons, assets, and API URLs using these headers without verifying if the sender is a trusted proxy. Because responses are cached using keys that do not include the host, a single forged request can inject attacker-controlled URLs into entries served to all other clients. This allows an attacker to supply a malicious VSIX package along with its own signature and public key, leading VS Code-compatible editors to install malicious software. This issue affects servers reachable directly by clients or those behind proxies that relay rather than overwrite these headers. **Recommendations** Configure the reverse proxy to set instead of relay the `X-Forwarded-Host`, `X-Forwarded-Proto`, and `X-Forwarded-Prefix` headers. Ensure the server is only reachable through the configured proxy. Flush the caches after applying configuration changes to remove poisoned entries.