Zip Slip Vulnerability in Code Extension Marketplace by Coder

CVE-2026-35454

What is CVE-2026-35454?

The Code Extension Marketplace, an open-source alternative to the VS Code Marketplace, is exposed to a Zip Slip vulnerability that allows maliciously crafted VSIX files to write arbitrary files outside the designated extension directory. This occurs because the extractZip function processes raw zip entry names without adequate boundary checks, allowing for directory traversal via filepath.Join. This flaw enables attackers to exploit the file writing capabilities, potentially compromising system security. The issue has been addressed in version 2.4.2 of the marketplace.

References