Eclipse Foundation Vulnerabilities and Affected Products
Vulnerabilities associated with Eclipse Open VSX.
Products
Clear product- Eclipse Glassfish12 vulnerabilities
- ThreadX12 vulnerabilities
- NetX Duo11 vulnerabilities
- Eclipse Theia10 vulnerabilities
- Eclipse Jetty9 vulnerabilities
- Eclipse Milo6 vulnerabilities
- Jetty6 vulnerabilities
- Eclipse OMR4 vulnerabilities
- Eclipse Vert.x4 vulnerabilities
- Mosquitto4 vulnerabilities
- OpenJ94 vulnerabilities
- USBX4 vulnerabilities
- Eclipse CSI - PIA3 vulnerabilities
- Eclipse BaSyx2 vulnerabilities
- Eclipse KUKSA - Databroker2 vulnerabilities
- Eclipse Open VSX2 vulnerabilities
- Eclipse OpenJ92 vulnerabilities
- Eclipse OpenMQ2 vulnerabilities
- Eclipse ThreadX - NetX Duo2 vulnerabilities
- Glassfish2 vulnerabilities
- NextX Duo2 vulnerabilities
- Open J92 vulnerabilities
- Parsson2 vulnerabilities
- Vert.x2 vulnerabilities
- BlueChi1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-13323MEDIUM | Generated title:Eclipse Open VSX Registry Stored Cross-Site ScriptingIn Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or Content-Disposition: attachment response header. An unauthenticated attacker can register a publisher account, upload a VSIX containing a crafted HTML payload, and induce an authenticated user to visit the resulting URL. The browser renders the file inline in the open-vsx.org origin context, enabling session token exfiltration, persi… CWE-79Jul 1, 2026 | CVSS4.1v3.1 | EPSS0.212% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-4983MEDIUM | Generated title:Eclipse Open VSX Registry Stored Cross-Site Scripting via SVG Icon UploadOpen VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security headers such as Content-Security-Policy or Content-Disposition: attachment. This allows an attacker to publish an extension with a malicious SVG icon and achieve stored cross-site scripting (XSS) when a user navigates directly to the icon URL. On deployments using local storage, script execution occurs within the Open VSX application or… CWE-79Jun 23, 2026 | CVSS4.1v3.1 | EPSS0.224% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |