CVE-2026-89321

A flaw was found in OpenVSX. A publisher can upload a small, highly compressible VSIX Visual Studio Code Extension file. When this file is processed, the server's WebResourceService decompresses it without limiting the size of the extracted content, leading to uncontrolled growth of temporary fil...

CVE-2025-12999

A flaw was found in openvsx-server. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution on client machines through HTTP cache poisoning. The server generates download and verification URLs from untrusted proxy headers, such as X-Forwarded-Host, without...

CVE-2026-89321

Publishing limits the compressed size of a VSIX ovsx.publishing.max-content-size, 512 MB by default but nothing limited how large an entry becomes when opened. On the first request to /vscode/unpkg/namespace/extension/version/path, WebResourceService opened the entry with ZipFile.getInputStream a...

EUVD-2026-77328

Publishing limits the compressed size of a VSIX ovsx.publishing.max-content-size, 512 MB by default but nothing limited how large an entry becomes when opened. On the first request to /vscode/unpkg/namespace/extension/version/path, WebResourceService opened the entry with ZipFile.getInputStream a...

CVE-2026-89321

Eclipse OpenVSX is vulnerable to a disk exhaustion issue in its WebResourceService . When a VSIX is first requested via the unpkg endpoint, the service opens a zip entry with ZipFile.getInputStream() and passes the decompressed stream to Files.copy() without counting bytes written. The resulting ...

PT-2026-91116

Publishing limits the compressed size of a VSIX ovsx.publishing.max-content-size, 512 MB by default but nothing limited how large an entry becomes when opened. On the first request to /vscode/unpkg/namespace/extension/version/path, WebResourceService opened the entry with ZipFile.getInputStream a...

CVE-2026-48027

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for 18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the...

CVE-2026-48027

Summary: CVE-2026-48027 affects Nx Console, a UI for Nx & Lerna. A malicious copy of Nx Console version 18.95.0 was published briefly in Visual Studio Marketplace (and OpenVSX) around 12:30–12:48 UTC (≈18 minutes) and 12:33–13:09 UTC (≈36 minutes) respectively. The compromised package allowed cod...

CVE-2026-48027

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for 18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the...

EUVD-2026-32550

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for 18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the...

CVE-2026-48027 Compromised Nx Console version 18.95.0

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for 18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the...

Nx Console security vulnerabilities

Nx Console is an open-source repository management interface that supports visual workflows and AI enhancements. Version Nx Console 18.95.0 contains a security vulnerability. This vulnerability stems from the release of a malicious version on the Visual Studio Marketplace and OpenVSX, which could...

PT-2026-44044

Name of the Vulnerable Software and Affected Versions Nx Console version 18.95.0 Description A malicious version of Nx Console, which serves as the user interface for Nx and Lerna, was published to the Visual Studio Marketplace and OpenVSX. The compromised version was available for approximately ...

CVE-2026-48027: Embedded Malicious Code

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for 18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the...

VulnCheck KEV: CVE-2026-48027

Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory...

CVE-2026-28353

Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX marketplace was compromised and contained malicious code designed to leverage local AI coding agent to collect and exfiltrate sensitive...

EUVD-2026-9869

Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX marketplace was compromised and contained malicious code designed to leverage local AI coding agent to collect and exfiltrate sensitive...

CVE-2026-28353

CVE-2026-28353 : The Trivy VSCode Extension (OpenVSX) version 1.8.12 was found compromised, containing malicious code designed to leverage a local AI coding agent to collect and exfiltrate sensitive information. The affected artifact distributed via the OpenVSX marketplace has been removed; users...

CVE-2026-28353 Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release

Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX marketplace was compromised and contained malicious code designed to leverage local AI coding agent to collect and exfiltrate sensitive...

CVE-2026-28353 Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release

Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX marketplace was compromised and contained malicious code designed to leverage local AI coding agent to collect and exfiltrate sensitive...