CVE-2026-4983: Eclipse Open VSX XSS Vulnerability

CVE-2026-4983 Overview

CVE-2026-4983 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Eclipse Open VSX Registry. The registry accepts SVG files as extension icons without sanitization and serves them with Content-Type: image/svg+xml. Responses omit Content-Security-Policy and Content-Disposition: attachment headers. An authenticated publisher can upload an extension whose icon contains embedded JavaScript. When a user navigates directly to the icon URL, the script executes in the browser.

Critical Impact
On deployments using local storage, script execution occurs within the Open VSX application origin, enabling session hijacking, authentication token theft, and unauthorized extension publishing.

Affected Products

Eclipse Open VSX Registry (eclipse:open_vsx)
Self-hosted Open VSX deployments using local storage
Open VSX deployments backed by external storage such as S3-backed CDNs (reduced impact)

Discovery Timeline

2026-06-23 - CVE-2026-4983 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-4983

Vulnerability Analysis

The Open VSX Registry distributes Visual Studio Code-compatible extensions and renders publisher-supplied icons in extension listing pages. Publishers can upload SVG files as icons. SVG is an XML-based format that supports embedded <script> elements and JavaScript event handlers such as onload and onclick.

The registry stores uploaded SVG content without stripping script elements or active content. When a browser requests the icon URL, the server responds with Content-Type: image/svg+xml and no restrictive security headers. The browser renders the SVG as an active document, executing any embedded JavaScript.

Impact depends on storage backend. Local storage deployments serve icons from the same origin as the application, so executed script can read cookies, session tokens, and call authenticated API endpoints to publish malicious extensions. External storage deployments such as open-vsx.org with an S3-backed CDN confine execution to the storage origin, limiting impact to phishing and credential harvesting through attacker-controlled pages.

Root Cause

The root cause is missing input sanitization of SVG payloads at upload time combined with insecure response headers at serve time. The application does not strip <script> tags, JavaScript event handlers, or xlink:href references from user-supplied SVG data. The HTTP response also lacks Content-Security-Policy and Content-Disposition: attachment, which would otherwise neutralize active content rendering.

Attack Vector

An attacker registers a publisher account and publishes an extension with an SVG icon containing a JavaScript payload inside a <script> element or an event handler attribute. The attacker then distributes a link pointing directly to the icon URL or triggers icon rendering in a context that executes the embedded script. Victim interaction is required, since the user must navigate to the crafted URL.

The vulnerability mechanism is documented in the Eclipse Security CVE Assignment. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2026-4983

Indicators of Compromise

Extension icon files containing <script> elements, on* event handler attributes, or javascript: URIs in xlink:href attributes
HTTP responses serving .svg icons without Content-Security-Policy or Content-Disposition: attachment headers
Unexpected outbound requests from authenticated Open VSX sessions to attacker-controlled domains
New extension publish events originating from accounts that did not initiate the action

Detection Strategies

Scan stored SVG icon files for active content patterns such as <script, onload=, onerror=, and javascript: substrings.
Inspect web server logs for direct requests to icon endpoints followed by anomalous API activity from the same session.
Monitor extension publishing API endpoints for activity that does not correlate with publisher web UI navigation.

Monitoring Recommendations

Alert on browser console errors and Content-Security-Policy violation reports from Open VSX domains.
Track new publisher account registrations followed by rapid extension uploads containing SVG icons.
Audit existing icon assets for embedded scriptable content as a baseline before applying fixes.

How to Mitigate CVE-2026-4983

Immediate Actions Required

Apply the Open VSX Registry security update referenced in the Eclipse advisory once available for your deployment.
Audit all stored SVG icon assets and remove or re-render files containing scriptable content.
Invalidate active user sessions and rotate authentication tokens if exploitation is suspected on local-storage deployments.

Patch Information

Refer to the Eclipse Security CVE Assignment for upstream remediation details and fixed version information.

Workarounds

Configure the web server or CDN to serve SVG icons with Content-Disposition: attachment to prevent inline browser rendering.
Add a restrictive Content-Security-Policy response header on icon paths that blocks inline scripts and external script sources.
Convert uploaded SVG icons to rasterized formats such as PNG before serving them to clients.
Restrict extension publishing privileges to vetted accounts until sanitization is in place.

bash

# Example nginx configuration to neutralize SVG icon rendering
location ~* \.svg$ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "default-src 'none'; sandbox";
    add_header X-Content-Type-Options "nosniff";
}