Go modules package
github.com/coder/code-marketplace
pkg:golang/github.com/coder/code-marketplace
Vulnerabilities (1)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-35454 | Med | 6.5 | < 1.2.3-0.20260402184705-988440dee05f | 1.2.3-0.20260402184705-988440dee05f | Apr 6, 2026 | The Code Extension Marketplace is an open-source alternative to the VS Code Marketplace. Prior to 2.4.2, Zip Slip vulnerability in coder/code-marketplace allowed a malicious VSIX file to write arbitrary files outside the extension directory. ExtractZip passed raw zip entry names |
- affected < 1.2.3-0.20260402184705-988440dee05ffixed 1.2.3-0.20260402184705-988440dee05f
The Code Extension Marketplace is an open-source alternative to the VS Code Marketplace. Prior to 2.4.2, Zip Slip vulnerability in coder/code-marketplace allowed a malicious VSIX file to write arbitrary files outside the extension directory. ExtractZip passed raw zip entry names