Remote Code Execution Vulnerability in Open VSX

CVE-2025-12999

What is CVE-2025-12999?

A significant vulnerability exists in Open VSX where the function UrlUtil.getBaseUrl incorrectly constructs URLs from HTTP headers such as X-Forwarded-Host without verifying if the sender is a trusted proxy. This allows an attacker to manipulate the response caching mechanism by injecting fraudulent headers, potentially serving malicious packages to clients using VS Code-compatible editors. Systems using vulnerable versions are at risk, especially if directly exposed to the internet or configured incorrectly regarding proxy headers. Mitigations include properly configuring reverse proxy settings to overwrite rather than relay problematic headers, ensuring the server isn't directly accessible, and flushing cached entries to remove any potential poison.

References