Eclipse Open VSX vulnerabilities

2 known vulnerabilities in Eclipse Open VSX from Eclipse Foundation. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Eclipse Open VSX: Insufficient Verification of Data Authenticity

  CVE-2025-12999Sep 21, 2026Eclipse Foundation

  UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back t

• 8.7 High severity

  Eclipse Open VSX: Improper Neutralization of Input During Web Page Generation

  CVE-2026-13323Jul 1, 2026Eclipse Foundation

  In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or Content-Disposition: attachment response header. An unauthenticated attacker can register a pub