CVE-2026-77157 Details
Description
ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute the contents of the archive, since no integrity check was performed on the download. Successful exploitation requires compromising "download.checkmarx.com" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx's VSCode/JetBrains extensions) or cx scan "sca-realtime" on an affected version would have extracted and executed that binary in place of the intended download. The download is now verified against a published SHA-256 checksum before extraction.
A vulnerability exists in Checkmarx ast-cli versions through 2.3.59, where the auto-update mechanism for downloading helper binaries from 'download.checkmarx.com' lacks proper integrity verification. This flaw allows an attacker who compromises the server to replace the downloaded archive with one containing a malicious binary. The absence of a checksum verification prior to extraction and execution means that the arbitrary binary could be executed on the developer's machine or within a CI pipeline, particularly when using Checkmarx's VSCode or JetBrains extensions. The issue has been addressed in version 2.3.60, where the download is now verified against a published SHA-256 checksum before extraction.
Users are advised to upgrade to Checkmarx ast-cli version 2.3.60 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Checkmarx/ast-cli | Checkmarx | ProductVendor |
| https://github.com/Checkmarx/ast-cli/security/advisories/GHSA-vf6p-x2fw-5hcg | Checkmarx | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-353 | Missing Support for Integrity Check | Checkmarx |
Affected Products
| Product | Versions |
|---|---|
| Checkmarx ast-cli | <= 2.3.59 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | Checkmarx |