CVE-2026-35454: Code Marketplace Path Traversal Flaw

CVE-2026-35454 Overview

CVE-2026-35454 is a Path Traversal (Zip Slip) vulnerability affecting the Code Extension Marketplace, an open-source alternative to the VS Code Marketplace. Prior to version 2.4.2, a malicious VSIX file could exploit improper path validation in the ExtractZip function to write arbitrary files outside the intended extension directory. The vulnerability stems from the function passing raw zip entry names to a callback that wrote files via filepath.Join without proper boundary checking. While filepath.Join resolved .. components, it failed to prevent the resulting path from escaping the base directory.

Critical Impact

Attackers can craft malicious VSIX extension packages to write files to arbitrary locations on the server, potentially leading to remote code execution, configuration tampering, or system compromise.

Affected Products

• Code Extension Marketplace versions prior to 2.4.2
• coder/code-marketplace (GitHub repository)
• Self-hosted VS Code Marketplace alternatives using vulnerable versions

Discovery Timeline

• 2026-04-06 - CVE-2026-35454 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35454

Vulnerability Analysis

This vulnerability belongs to the CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) category, commonly known as "Zip Slip." The Code Extension Marketplace processes VSIX files, which are essentially ZIP archives containing VS Code extensions. During the extraction process, the ExtractZip function failed to properly validate that extracted file paths remained within the designated extension directory.

The core issue lies in how the extraction callback handled file paths. When processing entries from a ZIP archive, the function used filepath.Join to construct the destination path by combining the base extraction directory with the entry name from the ZIP file. Although filepath.Join normalizes paths and resolves .. (parent directory) components, it does not inherently prevent directory traversal when the resulting path escapes the intended base directory.

An attacker could craft a malicious VSIX file containing entries with paths like ../../../etc/cron.d/malicious or ../../../.ssh/authorized_keys. When extracted, these would resolve to locations outside the extension directory, allowing arbitrary file writes anywhere the application has write permissions.

Root Cause

The root cause is insufficient path validation in the ExtractZip function. The function trusted the file paths embedded within ZIP archives without verifying that the final resolved path remained within the expected extraction directory. While filepath.Join handles path normalization, additional validation is required to ensure the resulting absolute path is a child of the intended base directory. This typically requires comparing the resolved path prefix against the canonical base path after joining.

Attack Vector

This vulnerability is exploitable over the network. An attacker can upload or provide a malicious VSIX extension package to a vulnerable Code Extension Marketplace instance. The attack does not require authentication and involves no user interaction beyond the marketplace processing the malicious package.

The attack flow involves crafting a VSIX file with specially constructed entry names containing directory traversal sequences. When the marketplace attempts to extract and install the extension, the malicious paths are processed, resulting in files being written to attacker-controlled locations on the filesystem. Depending on the deployment environment and file permissions, this could enable remote code execution through web shell uploads, cron job manipulation, SSH key injection, or overwriting critical configuration files.

Detection Methods for CVE-2026-35454

Indicators of Compromise

• Unexpected files appearing outside the extension storage directory
• VSIX files containing entries with .. path components in archive listings
• File system audit logs showing writes to sensitive directories during extension installation
• Anomalous file creation timestamps in system directories coinciding with extension uploads

Detection Strategies

• Implement file integrity monitoring on critical system directories and configuration files
• Analyze ZIP/VSIX file contents before extraction to detect path traversal patterns
• Monitor application logs for extraction errors or unusual file paths during extension processing
• Deploy endpoint detection rules to alert on filepath.Join operations resulting in paths outside expected directories

Monitoring Recommendations

• Enable audit logging for the extension installation directory and parent directories
• Configure alerts for any file writes outside the designated extension storage path
• Review uploaded VSIX packages for suspicious entry names using static analysis tools
• Implement real-time monitoring of the Code Extension Marketplace service for exploitation attempts

How to Mitigate CVE-2026-35454

Immediate Actions Required

• Upgrade Code Extension Marketplace to version 2.4.2 or later immediately
• Audit recently installed extensions for signs of compromise or malicious file writes
• Review file system integrity for unexpected modifications in sensitive directories
• Consider temporarily disabling extension uploads until the patch is applied

Patch Information

The vulnerability is fixed in Code Extension Marketplace version 2.4.2. The patch implements proper path validation to ensure extracted files cannot escape the designated extension directory. Organizations should update to this version as soon as possible.

For detailed information about the fix, refer to the GitHub Release v2.4.2 and the GitHub Security Advisory GHSA-8x9r-hvwg-c55h.

Workarounds

• Restrict VSIX upload capabilities to trusted administrators only until patching is complete
• Implement input validation at the network layer to reject VSIX files with suspicious path patterns
• Run the Code Extension Marketplace service with minimal filesystem permissions to limit write access
• Deploy the application in a containerized environment with read-only mounts for sensitive directories

# Configuration example
# Verify your Code Extension Marketplace version
code-marketplace --version

# Upgrade to patched version 2.4.2
# Follow your deployment method - example using Go install:
go install github.com/coder/code-marketplace@v2.4.2

# Audit extension directory for unexpected files
find /path/to/extensions -name "*.." -o -path "*/../*"

# Check for files written outside expected directories
ls -la /path/to/extensions/../