CVE-2026-13323 Details
Description
In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or Content-Disposition: attachment response header. An unauthenticated attacker can register a publisher account, upload a VSIX containing a crafted HTML payload, and induce an authenticated user to visit the resulting URL. The browser renders the file inline in the open-vsx.org origin context, enabling session token exfiltration, persistent Personal Access Token (PAT) generation, and unauthorized publication of malicious extension versions. Because Open VSX extensions are distributed to VS Code, VSCodium, Cursor, Windsurf, and compatible editors, a compromised extension update constitutes a supply chain attack against all downstream users.
A stored cross-site scripting vulnerability has been identified in Open VSX Registry versions prior to 1.0.2. The issue arises in the '/vscode/unpkg/' endpoint, which serves user-uploaded HTML files without proper security headers. An unauthenticated attacker can exploit this by registering a publisher account, uploading a VSIX file containing a malicious HTML payload, and tricking an authenticated user into visiting the generated URL. This exploitation occurs within the open-vsx.org origin context, allowing access to session cookies and other sensitive data. The vulnerability can lead to unauthorized actions such as generating a persistent Personal Access Token (PAT) and publishing malicious extension versions, creating a supply chain attack risk for users of VS Code and compatible editors.
Users can update to Open VSX Registry version 1.0.2 or later, which addresses this vulnerability by implementing proper HTTP headers and content type handling. The update is available through the Open VSX Registry GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/485 | CISA-ADP | ExploitIssue TrackingVendor Advisory |
| https://github.com/eclipse-openvsx/openvsx/pull/1922 | [email protected] | Issue TrackingPatch |
| https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/485 | [email protected] | ExploitIssue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| eclipse open vsx | < 1.0.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | Initial Analysis | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |