Eclipse Open Vsx (Eclipse Foundation) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-09-21. Vendor: Eclipse Foundation.

CVEs of Eclipse Open Vsx

• CVE-2025-12999 - CVSS 9.1 (critical), 2026-09-21: UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and…
• CVE-2026-13323 - CVSS 8.7 (high), 2026-07-01: In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a…
• CVE-2026-4983 - CVSS 5.4 (medium), 2026-06-23: Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security…