Eclipse Open Vsx vulnerabilities

4 CVEs affecting Eclipse Open Vsx, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-13323, published 2026-07-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-1007, published 2025-02-19. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details…
CVE-2026-13323, published 2026-07-01. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or Content-Disposition: attachment…
CVE-2026-4983, published 2026-06-23. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security headers such as Content-Security-Policy…
CVE-2025-6705, published 2025-06-27. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’s build scripts were executed without…