CVE-2026-35454: Code Extension Marketplace: Zip Slip Path Traversal
(updated )
A Zip Slip (CWE-22) vulnerability in coder/code-marketplace ≤ v2.4.1 allowed a malicious VSIX file to write arbitrary files outside the extension directory. ExtractZip passed raw zip entry names to a callback that wrote files via filepath.Join with no boundary check; filepath.Join resolved .. components but did not prevent the result from escaping the base path.
References
- github.com/advisories/GHSA-8x9r-hvwg-c55h
- github.com/coder/code-marketplace
- github.com/coder/code-marketplace/commit/988440dee05fceef8400ed725badc604dbf90792
- github.com/coder/code-marketplace/releases/tag/v2.4.2
- github.com/coder/code-marketplace/security/advisories/GHSA-8x9r-hvwg-c55h
- nvd.nist.gov/vuln/detail/CVE-2026-35454
Code Behaviors & Features
Detect and mitigate CVE-2026-35454 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →