GHSA-8X9R-HVWG-C55H
Vulnerability from github – Published: 2026-04-04 06:26 – Updated: 2026-04-07 14:21Zip Slip Path Traversal in coder/code-marketplace
Summary
A Zip Slip (CWE-22) vulnerability in coder/code-marketplace ≤ v2.4.1 allowed a malicious VSIX file to write arbitrary files outside the extension directory. ExtractZip passed raw zip entry names to a callback that wrote files via filepath.Join with no boundary check; filepath.Join resolved .. components but did not prevent the result from escaping the base path.
Root Cause
ExtractZip passed the raw, attacker-controlled zf.Name to a caller-supplied callback:
return false, fn(zf.Name, zr) // zf.Name not sanitized
AddExtension constructed the output path with filepath.Join and no boundary check:
path := filepath.Join(dir, name) // zip loop
path := filepath.Join(dir, file.RelativePath) // extra files loop
filepath.Clean resolved .. lexically but did not confine the result to dir:
filepath.Join("/srv/ext/pub/1.0", "../../../../etc/cron.d/evil")
→ "/etc/cron.d/evil"
Attack Scenario
An authenticated user (any upload-capable role) would submit a VSIX containing path-traversal entries.
On extraction, files would land at attacker-chosen paths writable by the marketplace process, enabling persistence (cron/init injection), SSH key injection, ld.so.preload hijacking, or binary overwrite depending on process privileges.
Fix
Addressed in https://github.com/coder/code-marketplace/releases/tag/v2.4.2
Recognition
Coder would like to thank Kandlaguduru Vamsi for responsibly disclosing this issue in accordance with https://coder.com/security/policy
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/coder/code-marketplace"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.3-0.20260402184705-988440dee05f"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35454"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-04T06:26:02Z",
"nvd_published_at": "2026-04-06T22:16:23Z",
"severity": "HIGH"
},
"details": "# Zip Slip Path Traversal in coder/code-marketplace\n\n## Summary\n\nA Zip Slip (CWE-22) vulnerability in `coder/code-marketplace` \u2264 v2.4.1 allowed a malicious VSIX file to write arbitrary files outside the extension directory. `ExtractZip` passed raw zip entry names to a callback that wrote files via `filepath.Join` with no boundary check; `filepath.Join` resolved `..` components but did not prevent the result from escaping the base path.\n\n\n## Root Cause\n\n`ExtractZip` passed the raw, attacker-controlled `zf.Name` to a caller-supplied callback:\n\n```go\nreturn false, fn(zf.Name, zr) // zf.Name not sanitized\n```\n\n`AddExtension` constructed the output path with `filepath.Join` and no boundary check:\n\n```go\npath := filepath.Join(dir, name) // zip loop\npath := filepath.Join(dir, file.RelativePath) // extra files loop\n```\n\n`filepath.Clean` resolved `..` lexically but did not confine the result to `dir`:\n\n```\nfilepath.Join(\"/srv/ext/pub/1.0\", \"../../../../etc/cron.d/evil\")\n \u2192 \"/etc/cron.d/evil\"\n```\n\n## Attack Scenario\n\nAn authenticated user (any upload-capable role) would submit a VSIX containing path-traversal entries.\n\nOn extraction, files would land at attacker-chosen paths writable by the marketplace process, enabling persistence (cron/init injection), SSH key injection, `ld.so.preload` hijacking, or binary overwrite depending on process privileges.\n\n## Fix\n\nAddressed in https://github.com/coder/code-marketplace/releases/tag/v2.4.2\n\n## Recognition\nCoder would like to thank [Kandlaguduru Vamsi](https://www.linkedin.com/in/vamsi-k-5419632a9/) for responsibly disclosing this issue in accordance with https://coder.com/security/policy",
"id": "GHSA-8x9r-hvwg-c55h",
"modified": "2026-04-07T14:21:34Z",
"published": "2026-04-04T06:26:02Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/coder/code-marketplace/security/advisories/GHSA-8x9r-hvwg-c55h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35454"
},
{
"type": "WEB",
"url": "https://github.com/coder/code-marketplace/commit/988440dee05fceef8400ed725badc604dbf90792"
},
{
"type": "PACKAGE",
"url": "https://github.com/coder/code-marketplace"
},
{
"type": "WEB",
"url": "https://github.com/coder/code-marketplace/releases/tag/v2.4.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Code Extension Marketplace: Zip Slip Path Traversal"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.