Known vulnerabilities in Eclipse Foundation Eclipse Open VSX
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2025-12999 | UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the… | 9.1 Critical | Sep 21, 2026 |
| CVE-2026-13323 | In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type:… | 4.1 Medium | Jul 1, 2026 |
| CVE-2026-4983 | Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with… | 4.1 Medium | Jun 23, 2026 |