Eclipse Foundation Eclipse Open Vsx
3 CVEs affecting Eclipse Foundation Eclipse Open Vsx. Latest disclosed: 2026-09-21. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13323 | Medium | 4.1 | 2026-07-01 | In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Poli… |
CVE-2026-4983 | Medium | 4.1 | 2026-06-23 | Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security h… |
CVE-2025-12999 | | 2026-09-21 | UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forw… |