CVE-2026-4983— Eclipse Foundation Eclipse Open VSX 跨站脚本漏洞

N/A

Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security headers such as Content-Security-Policy or Content-Disposition: attachment. This allows an attacker to publish an extension with a malicious SVG icon and achieve stored cross-site scripting (XSS) when a user navigates directly to the icon URL. On deployments using local storage, script execution occurs within the Open VSX application origin, enabling session hijacking, authentication token theft, and unauthorized extension publishing. On deployments backed by external storage (such as open-vsx.org with an S3-backed CDN), execution is confined to the storage origin, reducing impact but still permitting phishing attacks and credential harvesting through attacker-crafted pages.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Eclipse Foundation Eclipse Open VSX 跨站脚本漏洞

Eclipse Foundation Eclipse Open VSX是Eclipse Foundation基金会的一款扩展市场平台。 Eclipse Foundation Eclipse Open VSX存在跨站脚本漏洞，该漏洞源于未在存储前清理上传为扩展图标的SVG文件，并且以Content-Type: image/svg+xml提供而无安全标头，可能导致攻击者发布带恶意SVG图标的扩展，用户直接导航至图标URL时实现存储型跨站脚本，从而引发会话劫持、身份验证令牌窃取和未授权扩展发布；对于外部存储部署

N/A

N/A