CVE-2025-12999
Received Received - Intake

Header Injection in Open VSX Registry

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Eclipse Foundation

Description
UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back to the client-supplied Host header. Those responses are cached under keys that do not include the host (extension.json since 0.6.0, namespace.details.json since 0.9.0, sitemap since 0.14.5, latest.extension.version.vscode since 0.34.2). A single request carrying a forged header therefore places attacker-chosen URLs into an entry served to every other client for the lifetime of that entry — one hour by default, and cluster-wide where ovsx.redis.enabled is set. The VSIX download URL, its signature URL and the public key URL are all derived from the same base URL, so extension signing does not limit the impact: an attacker who poisons an entry supplies the package, the signature over it, and the key used to verify it. Exploitability depends on deployment topology. A server reachable directly by clients, or fronted by a proxy that relays the client's X-Forwarded-Host rather than overwriting it, is exploitable by an unauthenticated remote attacker. A proxy that overwrites the header is not. An unauthenticated attacker can poison Open VSX's per-extension metadata cache with attacker-controlled download, signature, and public-key URLs by supplying a crafted X-Forwarded-Host header, causing downstream VS Code-compatible editors to fetch and install a malicious VSIX. Workarounds (unpatched versions) 1. Configure the reverse proxy to set rather than relay X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix — note that nginx's $host is the client's Host header and is not a safe value. 2. Ensure the server is not reachable except through that proxy. 3. Flush the caches afterwards; poisoned entries survive the configuration change.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2025-12999
EUVD
EUVD-2025-210973

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
open_vsx open_vsx From 0.6.0 (inc) to 0.9.0 (exc)
open_vsx open_vsx From 0.9.0 (inc) to 0.14.5 (exc)
open_vsx open_vsx From 0.14.5 (inc)
open_vsx open_vsx From 0.34.2 (inc)
eclipse openvsx From 0.6.0 (inc)
eclipse openvsx to 1.1.2 (inc)
eclipse openvsx 1.2.0
eclipse openvsx-server 1.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-12999 is a cache poisoning vulnerability in the Open VSX registry server. It allows an unauthenticated attacker to inject malicious URLs into cached responses by forging X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Prefix headers. These poisoned URLs are then served to all users for the cache's lifetime, which defaults to one hour or cluster-wide if Redis is enabled.

Detection Guidance

Detect this vulnerability by checking if your Open VSX server is exposed directly to clients or uses a proxy that relays X-Forwarded-Host headers. Inspect network traffic for requests with forged X-Forwarded-Host headers targeting the /vscode/gallery/{namespace}/{extension}/latest endpoint. Monitor cache entries for unexpected hostnames in cached responses.

Impact Analysis

An attacker can trick users into downloading and installing a malicious VSIX package via their VS Code-compatible editor. The attacker controls the package, its signature, and the public key used for verification, leading to potential execution of malicious code with full extension-host privileges on the victim's system.

Compliance Impact

This vulnerability could lead to unauthorized code execution, data breaches, or loss of confidentiality and integrity. Compliance with GDPR (data protection) and HIPAA (health information security) may be impacted due to potential exposure of sensitive data or unauthorized system access.

Mitigation Strategies
  • Configure your reverse proxy to set (not relay) X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Prefix headers.
  • Ensure the Open VSX server is only accessible through the configured proxy.
  • Upgrade to Open VSX versions 1.2.0 or later to apply the official patch.
  • Set the ovsx.server.url configuration to explicitly define the base URL and ignore forwarded headers.
  • Flush all caches after applying changes to remove any poisoned entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-12999. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart