PT-2026-30337 · Coder · Coder

Vamsik2K5 · Published 2026-04-04 · Updated 2026-04-06 · CVE-2026-35454

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Coder/code-marketplace versions through 2.4.1

Description A Zip Slip vulnerability allows a malicious VSIX file to write arbitrary files outside the extension directory. The ExtractZip function passes raw zip entry names to a callback that writes files using filepath.Join without a boundary check. filepath.Join resolves '..' components but does not prevent the result from escaping the base path. An authenticated user can submit a VSIX containing path-traversal entries, potentially leading to persistence, SSH key injection, or binary overwrite depending on process privileges.

Recommendations Update to version 2.4.2 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-35454

GHSA-8X9R-HVWG-C55H

Affected Products

Coder

References · 9

• https://osv.dev/vulnerability/GHSA-8x9r-hvwg-c55h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35454 · Security Note
• https://github.com/coder/code-marketplace/commit/988440dee05fceef8400ed725badc604dbf90792 · Note
• https://github.com/coder/code-marketplace · Note
• https://github.com/coder/code-marketplace/releases/tag/v2.4.2 · Note
• https://github.com/coder/code-marketplace/security/advisories/GHSA-8x9r-hvwg-c55h · Note
• https://twitter.com/CVEnew/status/2041282860943086014 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1sdyq51/resumen_diario_de_vulnerabilidades_06042026 · Reddit Post
• https://twitter.com/pulsepatchio/status/2040803639527092504 · Twitter Post