Open VSX Registry HTML File Content Spoofing Vulnerability

Detection Guidance

Detection of CVE-2026-13323 involves identifying if your system or network interacts with the vulnerable Open VSX Registry versions before 1.0.2 and if malicious VSIX extensions have been uploaded or accessed.

You can monitor network traffic or logs for requests to the /vscode/unpkg/ endpoint on open-vsx.org that serve HTML files without Content-Security-Policy or Content-Disposition headers.

Suggested commands include using curl or similar tools to inspect HTTP headers of files served from the endpoint, for example:

• curl -I https://open-vsx.org/vscode/unpkg/<path-to-file>
• Look for missing Content-Security-Policy and Content-Disposition headers in the response.

Additionally, you can audit publisher accounts and uploaded VSIX extensions for suspicious or unauthorized content.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Open VSX Registry versions before 1.0.2, where the /vscode/unpkg/ endpoint serves user-supplied HTML files without proper security headers like Content-Security-Policy or Content-Disposition: attachment.

An unauthenticated attacker can register a publisher account, upload a VSIX extension containing a malicious HTML payload, and trick an authenticated user into visiting the crafted URL. Because the browser renders the file inline within the open-vsx.org origin, the attacker can execute arbitrary JavaScript.

This allows the attacker to steal session tokens, generate persistent Personal Access Tokens (PATs), and publish malicious updates to extensions, which are then automatically distributed to all users of those extensions, effectively enabling a supply chain attack.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to session token theft and unauthorized generation of persistent Personal Access Tokens, allowing attackers to impersonate users with high privileges.

Attackers can publish malicious updates to popular extensions, which are then automatically delivered to all downstream users, compromising their developer environments without further interaction.

This results in a supply chain attack affecting all users of the compromised extensions, potentially leading to unauthorized code execution, data exfiltration, and loss of integrity in development workflows.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-13323, ensure that your Open VSX Registry is updated to version 1.0.2 or later, which includes fixes that add strict HTTP security headers to served files.

• Apply the patch that introduces the following security measures:
• Add the X-Content-Type-Options: nosniff header to prevent browsers from guessing content types.
• Implement a strict Content-Security-Policy for user-controlled input.
• Set appropriate Content-Type headers such as text/plain for viewable files and application/octet-stream for others.
• Use Content-Disposition: attachment for non-viewable files to prevent inline rendering.

These steps reduce the risk of Cross-Site Scripting (XSS) attacks and prevent malicious HTML payloads from executing in the open-vsx.org origin context.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability enables an attacker to exfiltrate session tokens and generate persistent Personal Access Tokens (PATs), leading to unauthorized publication of malicious extension versions. Such unauthorized access and data exfiltration can compromise confidentiality and integrity of user data.

Because the attack can lead to session hijacking and supply chain compromise affecting downstream users, it may result in violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and ensuring integrity of software used in processing such data.

The lack of proper security headers and the ability to execute arbitrary JavaScript in the context of open-vsx.org increases the risk of data breaches and unauthorized data processing, which are critical compliance concerns under these standards.

Useful 0 Not Useful 0