CVE-2026-77157 Checkmarx CVE debrief

Who should care

Developers and security teams using ast-cli and Checkmarx's VSCode/JetBrains extensions or cx scan 'sca-realtime' should verify the integrity of the helper binaries and ensure the latest version is used.

Why it matters

CVE-2026-77157 allows an attacker to execute arbitrary binaries on developer machines or CI pipelines using the ast-cli tool, requiring verification of the tool's version and configuration to determine exposure.

• An attacker could compromise the download server and replace the served archive with an arbitrary binary, allowing for code execution on developer machines or CI pipelines.
• The vulnerability requires verification of the ast-cli version and configuration to determine exposure.
• The fix involves verifying the download against a published SHA-256 checksum before extraction.

Technical summary

The ast-cli tool downloads and executes helper binaries without performing integrity checks, allowing an attacker to substitute the served archive with an arbitrary binary. This could lead to code execution on developer machines or CI pipelines. The vulnerability requires verification of the ast-cli version and configuration to determine exposure. The fix involves verifying the download against a published SHA-256 checksum before extraction and execution. Successful exploitation requires compromising 'download.checkmarx.com' and replacing the served archive with one containing an attacker-controlled binary.

Defensive priority

Developers and security teams should verify the integrity of the ast-cli helper binaries and ensure the latest version is used.

Recommended defensive actions

• Verify the integrity of the ast-cli helper binaries using the published SHA-256 checksum
• Ensure the latest version of ast-cli is used
• Review and update the CI pipeline and developer machine configurations to use the updated ast-cli version
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in ast-cli, which downloads and executes binaries without integrity checks. The vulnerability requires verification of the ast-cli version and configuration to determine exposure. An attacker could compromise the download server and replace the served archive with an arbitrary binary, allowing for code execution on developer machines or CI pipelines. The fix involves verifying the download against a published SHA-256 checksum before extraction. Developers and security 3

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.