CVE-2026-35454

OVERVIEW CVE-2026-35454 is a Zip Slip vulnerability in the Code Extension Marketplace (coder/code-marketplace), an open-source alternative to the VS Code Marketplace. Versions prior to 2.4.2 are affected. The vulnerability allows a malicious VSIX file to write arbitrary files outside the intended extension directory, bypassing directory traversal protections. SEVERITY The vulnerability stems from improper input validation in the ExtractZip function, which passes raw zip entry names to a file writing callback without boundary checks. While the filepath.Join function resolves ".." components, it fails to prevent the resulting path from escaping the base directory. The FAUCET Risk Score of 51.0/100 indicates moderate concern, though a CVSS score was not assigned. The attack requires local or user interaction through a malicious VSIX file upload. EXPLOITATION STATUS This vulnerability is not currently being actively exploited in the wild, as indicated by its absence from the Known Exploited Vulnerabilities (KEV) catalog and its inactive status on security hotlists. The extremely low EPSS score of 0.00023 suggests minimal real-world exploitation likelihood. No public exploit code is widely available, and community attention appears limited. Organizations should update to version 2.4.2 to remediate this risk, particularly if they operate instances of Code Extension Marketplace.