CVE-2026-35454 coder CVE debrief

Who should care

Users of the Code Extension Marketplace prior to version 2.4.2 should update to the latest version to mitigate this vulnerability. Developers and administrators who utilize VS Code and the Code Extension Marketplace for development environments are particularly advised to review their current version and update as necessary.

Technical summary

CVE-2026-35454 is a Zip Slip vulnerability in the Code Extension Marketplace. It occurs because the ExtractZip function passes raw zip entry names to a callback that writes files without properly checking the file paths. This allows a malicious VSIX file to write files outside the intended extension directory, potentially leading to arbitrary file writes on the system. The vulnerability was addressed in version 2.4.2 of the Code Extension Marketplace.

Defensive priority

High

Recommended defensive actions

• Update to version 2.4.2 or later of the Code Extension Marketplace.
• Review and validate the integrity of VSIX files before installation.
• Implement additional monitoring for suspicious file system modifications.
• Consider using compensating controls such as restrictive file system permissions.
• Perform an asset inventory to identify systems that may be affected.
• Review change management processes to ensure timely application of security updates.
• Track and verify the source of all VSIX files installed.

Evidence notes

The CVE record was published on 2026-04-06T22:16:23.760Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability details were obtained from the NVD and the Code Extension Marketplace's release notes.

Official resources