CVE-2025-1007

CVE-2025-1007 affects OpenVSX, specifically versions v0.9.0 through v0.20.0. The vulnerability arises in the /user/namespace/{namespace}/details API (and the related /user/namespace/{namespace}/details/logo) where a non-owner/non-contributor user can edit all namespace details (name, description,...

CVE-2025-6705

The CVE-2025-6705 vulnerability affects the Eclipse Open VSX Registry, specifically its automated publishing system. The issue stems from build scripts executing without proper isolation, potentially exposing a privileged token that could be used to publish new extension versions under any namesp...