High, CVSS 8.7GoPublished
Code Extension Marketplace: Zip Slip Path Traversal
CVE-2026-35454 · GHSA-8x9r-hvwg-c55h
- Affected
- Go github.com/coder/code-marketplace < 1.2.3-0.20260402184705-988440dee05f
- Fixed in
- 1.2.3-0.20260402184705-988440dee05f· Vendor fix available
- Issue
- Zip Slip Path Traversal in coder/code-marketplace Summary A Zip Slip (CWE-22) vulnerability in coder/code-marketplace ≤ v2.4.1 allowed a malicious VSIX file to write arbitrary files outside the extension directory. ExtractZip passed raw zip entry names to a callback that wrote files via filepath.Join with no boundary check; filepath.Join resolved .. components but did not prevent the result from escaping the base path. Root Cause ExtractZip passed the raw, attacker-controlled zf.Name to a caller-supplied callback: AddExtension constructed the output path with filepath.Join and no boundary check: filepath.Clean resolved .. lexically but did not confine the result to dir: Attack Scenario An authenticated user (any upload-capable role) would submit a VSIX containing path-traversal entries. On extraction, files would land at attacker-chosen paths writable by the marketplace process, enabling persistence (cron/init injection), SSH key injection, ld.so.preload hijacking, or binary…
Recommended action: Upgrade to 1.2.3-0.20260402184705-988440dee05f (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.