PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35454 coder CVE debrief

The Code Extension Marketplace, an open-source alternative to the VS Code Marketplace, was vulnerable to a Zip Slip issue prior to version 2.4.2. This vulnerability, tracked as CVE-2026-35454, allowed a malicious VSIX file to write arbitrary files outside the extension directory. The issue arose because ExtractZip passed raw zip entry names to a callback that wrote files via filepath.Join with no boundary check; filepath.Join resolved .. components but did not prevent the result from escaping the base path. This vulnerability was fixed in version 2.4.2.

Vendor
coder
Product
code-marketplace
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-07-24
Advisory published
2026-04-06
Advisory updated
2026-07-24

Who should care

Users of the Code Extension Marketplace prior to version 2.4.2 should update to the latest version to mitigate this vulnerability. Developers and administrators who utilize VS Code and the Code Extension Marketplace for development environments are particularly advised to review their current version and update as necessary.

Technical summary

CVE-2026-35454 is a Zip Slip vulnerability in the Code Extension Marketplace. It occurs because the ExtractZip function passes raw zip entry names to a callback that writes files without properly checking the file paths. This allows a malicious VSIX file to write files outside the intended extension directory, potentially leading to arbitrary file writes on the system. The vulnerability was addressed in version 2.4.2 of the Code Extension Marketplace.

Defensive priority

High

Recommended defensive actions

  • Update to version 2.4.2 or later of the Code Extension Marketplace.
  • Review and validate the integrity of VSIX files before installation.
  • Implement additional monitoring for suspicious file system modifications.
  • Consider using compensating controls such as restrictive file system permissions.
  • Perform an asset inventory to identify systems that may be affected.
  • Review change management processes to ensure timely application of security updates.
  • Track and verify the source of all VSIX files installed.

Evidence notes

The CVE record was published on 2026-04-06T22:16:23.760Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability details were obtained from the NVD and the Code Extension Marketplace's release notes.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35454 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35454

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35454 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35454

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.