CVE-2026-4983

Name of the Vulnerable Software and Affected Versions Open VSX Registry (affected versions not specified)

Description The software fails to sanitize SVG files uploaded as extension icons before storage and serves them with the 'Content-Type: image/svg+xml' header without security headers like 'Content-Security-Policy' or 'Content-Disposition: attachment'. This allows an attacker to publish an extension with a malicious SVG icon, leading to stored cross-site scripting (XSS)—a flaw where malicious scripts are permanently stored on the server and executed in the victim's browser—when a user visits the icon URL. In deployments using local storage, script execution occurs within the application origin, potentially enabling session hijacking, authentication token theft, and unauthorized extension publishing. In deployments using external storage, such as an S3-backed CDN, execution is limited to the storage origin, which may still allow phishing and credential harvesting.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.