Unknown · Open-Vsx.Org · CVE-2025-6705
Name of the Vulnerable Software and Affected Versions:
open-vsx.org (affected versions not specified)
Description:
The issue allowed an attacker to run arbitrary build scripts for auto-published extensions due to missing sandboxing of CI job runs. An attacker with access to an existing extension could take over the service account of the marketplace.
Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.