Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-77157— ast-cli: Auto-update downloads are not verified against a checksum before execution

Quick assessment

Affected
Checkmarx github.com/checkmarx/ast-cli
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ast-cli 在其自动更新流程中，会从 "download.checkmarx.com" 下载两个辅助二进制文件：Vorpal ASCA 实时引擎和 SCA Resolver。该流程由 Checkmarx 的 VSCode/JetBrains 扩展插件以及 命令触发。 在修复之前，下载的归档文件在提取和执行前并未进行校验和验证。因此，若攻击者能够替换服务器提供的归档文件，即可向 ast-cli 提供任意二进制程序。由于下载过程未执行完整性检查，ast-cli 会直接提取并执行该归档中的内容。 成功利用此漏洞需要攻

CVSS 6.4 · Medium

Affected Version Matrix 2

VendorProduct Version RangeStatus
Checkmarx github.com/checkmarx/ast-cli ≤ 2.3.59 affected
2.3.60 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77157

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ast-cli: Auto-update downloads are not verified against a checksum before execution
Source: CVE Program / CVE List V5
Vulnerability Description
ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute the contents of the archive, since no integrity check was performed on the download. Successful exploitation requires compromising "download.checkmarx.com" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx's VSCode/JetBrains extensions) or cx scan "sca-realtime" on an affected version would have extracted and executed that binary in place of the intended download. The download is now verified against a published SHA-256 checksum before extraction.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
缺失完整性检查支持
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Checkmarx github.com/checkmarx/ast-cli 0 ~ 2.3.59 -

II. Public POCs for CVE-2026-77157

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77157

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-77157 (1)

Vendor Pages for CVE-2026-77157 (1)

IV. Related Vulnerabilities

Same product: github.com/checkmarx/ast-cli
Same vendor: Checkmarx
Same weakness: CWE-353

V. Comments for CVE-2026-77157

No comments yet

Leave a comment