Stored XSS in Open VSX Registry Leads to Publisher Account Takeover

Vulnerability Overview Vulnerability Name: Stored XSS in Open VSX Registry leading to Publisher Account Takeover Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) Description: An attacker can register a free publisher account and upload a VSIX extension containing a malicious HTML file. When other users visit this extension, arbitrary JavaScript code is executed. Due to the absence of and headers in the Extension Host server's response, the browser renders the file content, thereby leaking sensitive information such as the user's session tokens, cookies, and . Attackers can exploit this information to hijack the victim's session, generate persistent Personal Access Tokens (PATs), and use these credentials to take over the victim's publisher account. Scope of Impact Affected Users: All users of VS Code, VSCodium, Cursor, and Windsurf Severity: High CVSS 3.1 Vector: CVSS 3.1 Score: 8.8 Remediation Current Status: Unfixed Recommended Actions: - Add and headers to the Extension Host server responses to prevent the browser from rendering malicious file content. - Strictly validate and filter user-uploaded HTML files to prevent the execution of malicious scripts. - Regularly update and audit extension security to ensure no known vulnerabilities exist. Proof of Concept (POC) No specific POC code or exploit code was provided in the page. Additional Information Reporter: Golan Myers Report Date: 3 weeks ago Status: Completed Assigned To: Martin Lowe, Thomas Neidhart Labels: Confirmed Participants: 7 people --- Summary: This vulnerability is a stored XSS flaw that may lead to publisher account takeover, affecting all users of the relevant IDEs. It remains unfixed; the aforementioned measures are recommended for protection.

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS in Open VSX Registry Leads to Publisher Account Takeover