Arbitrary Binary Execution Vulnerability in Checkmarx ast-cli
CVE-2026-77157

6.3MEDIUM

Key Information:

Vendor

Checkmarx

Status
Github.com/checkmarx/ast-cli
Vendor
CVE Published:
22 October 2026

What is CVE-2026-77157?

The Checkmarx ast-cli tool contains a vulnerability that allows for the arbitrary execution of binaries due to a lack of integrity verification during the auto-update process. Specifically, when using extensions such as VSCode and JetBrains, the tool downloads binaries from 'download.checkmarx.com' without validating their authenticity against a checksum. This presents a significant risk, as an attacker could compromise the download server and serve a malicious archive. Developers utilizing affected versions could unknowingly execute a harmful binary, posing serious threats to system integrity and data security. A fix has been implemented that now incorporates SHA-256 checksum validation to ensure the integrity of downloaded files.

Affected Version(s)

github.com/checkmarx/ast-cli 0 <= 2.3.59

github.com/checkmarx/ast-cli 2.3.60

References

https://github.com/Checkmarx/ast-cli
product
https://github.com/Checkmarx/ast-cli/security/advisories/...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sebástian Alba | @Sebasteuo
.