CVE-2026-4983 Details

A stored cross-site scripting vulnerability has been identified in the Open VSX Registry. This issue arises because the registry does not properly sanitize SVG files uploaded as extension icons before storing them. As a result, these files are served with the Content-Type 'image/svg+xml' and lack essential security headers such as Content-Security-Policy or Content-Disposition: attachment. This oversight enables an attacker to upload an extension with a harmful SVG icon that executes scripts when a user accesses the icon's URL. In deployments using local storage, the script runs within the Open VSX application origin, leading to session hijacking, theft of authentication tokens, and unauthorized publishing of extensions. Conversely, in deployments that utilize external storage, like open-vsx.org with an S3-backed CDN, the script execution is limited to the storage origin. While this reduces the impact, it still allows for phishing attacks and credential harvesting through pages crafted by the attacker.

Users can update to Open VSX version 0.34.1 or later, where the vulnerability has been addressed by rejecting extensions that include SVG files as icons.