Executive Summary

CVE-2026-22685 is a critical path traversal vulnerability in the DevToys extension installation mechanism affecting versions 2.0.0.0 through 2.0.8.0. When DevToys processes extension packages (NUPKG archives), it does not properly validate file paths inside the archive. Malicious packages can include crafted file paths with sequences like ../../ that cause files to be extracted outside the intended extensions directory. This allows an attacker to overwrite arbitrary files on the user's system with the privileges of the DevToys process, potentially leading to code execution, configuration tampering, or corruption of application or system files. The vulnerability is known as a "Zip Slip" attack and was patched in version 2.0.9.0. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to overwrite arbitrary files on your system with the privileges of the DevToys process. This could lead to dropping executable payloads, modifying configuration files, corrupting application or system files, and potentially executing arbitrary code depending on your environment and system context. The impact includes high confidentiality, integrity, and availability risks. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves path traversal during the extraction of DevToys extension packages (NUPKG archives). Detection can focus on monitoring for suspicious file extraction activities outside the intended extensions directory, especially files with path traversal patterns like '../../'. You can inspect recently extracted extension files for unexpected file paths or check logs for critical security violation entries referencing extension IDs. Since the vulnerability exploits crafted archive entries, scanning installed extension packages for entries containing '../' sequences can help detect attempts. Specific commands are not provided in the resources, but general approaches include searching extracted extension directories for files outside expected paths and reviewing DevToys logs for installation errors or security violation messages. [1, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include: 1) Updating DevToys to version 2.0.9.0 or later, where the vulnerability is patched. 2) Avoid installing untrusted or third-party extensions until the update is applied. 3) Alternatively, roll back to DevToys version 1.* if updating is not immediately possible. These steps prevent exploitation by ensuring the extension installation mechanism properly validates file paths and blocks path traversal attempts. [1]

Useful 0 Not Useful 0