Search
Find a vulnerability
Search criteria
6 vulnerabilities by Checkmarx
CVE-2026-77157 (GCVE-0-2026-77157)
Vulnerability from nvd – Published: 2026-10-22 17:50 – Updated: 2026-10-22 17:50
VLAI
EPSS
VEX
Title
ast-cli: Auto-update downloads are not verified against a checksum before execution
Summary
ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime".
Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute the contents of the archive, since no integrity check was performed on the download.
Successful exploitation requires compromising "download.checkmarx.com" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx's VSCode/JetBrains extensions) or cx scan "sca-realtime" on an affected version would have extracted and executed that binary in place of the intended download.
The download is now verified against a published SHA-256 checksum before extraction.
Severity
6.4 (Medium)
CWE
- CWE-353 - Missing support for integrity check
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Checkmarx/ast-cli | product |
| https://github.com/Checkmarx/ast-cli/security/adv… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Checkmarx | github.com/checkmarx/ast-cli |
Affected:
0 , ≤ 2.3.59
(semver)
Unaffected: 2.3.60 (semver) |
Date Public
2026-10-19 23:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://golang.org/pkg",
"defaultStatus": "unaffected",
"packageName": "github.com/checkmarx/ast-cli",
"product": "github.com/checkmarx/ast-cli",
"repo": "https://github.com/checkmarx/ast-cli",
"vendor": "Checkmarx",
"versions": [
{
"lessThanOrEqual": "2.3.59",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.3.60",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Seb\u00e1stian Alba | @Sebasteuo"
}
],
"datePublic": "2026-10-19T23:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003east-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from \"download.checkmarx.com\" as part of its auto-update flow, triggered by the Checkmarx\u2019s \"VSCode/JetBrains\" extensions and by cx scan \"sca-realtime\".\u003c/p\u003e\u003cp\u003ePrior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract\u0026nbsp;\u003cspan\u003eand execute the contents of the archive, since no integrity check was performed on\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe download.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eSuccessful exploitation requires compromising \"download.checkmarx.com\" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx\u0027s VSCode/JetBrains extensions) or cx scan \"sca-realtime\" on an affected version would have extracted and executed that binary in place of the intended download.\u003cspan\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003eThe download is now verified against a published SHA-256 checksum before extraction.\u003c/p\u003e"
}
],
"value": "ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from \"download.checkmarx.com\" as part of its auto-update flow, triggered by the Checkmarx\u2019s \"VSCode/JetBrains\" extensions and by cx scan \"sca-realtime\".\n\n\n\nPrior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract\u00a0and execute the contents of the archive, since no integrity check was performed on\u00a0the download.\n\n\n\nSuccessful exploitation requires compromising \"download.checkmarx.com\" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx\u0027s VSCode/JetBrains extensions) or cx scan \"sca-realtime\" on an affected version would have extracted and executed that binary in place of the intended download.\n\n\n\nThe download is now verified against a published SHA-256 checksum before extraction."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-353",
"description": "CWE-353 Missing support for integrity check",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T17:50:51.933Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/Checkmarx/ast-cli"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/Checkmarx/ast-cli/security/advisories/GHSA-vf6p-x2fw-5hcg"
}
],
"source": {
"advisory": "GHSA-vf6p-x2fw-5hcg",
"discovery": "EXTERNAL"
},
"title": "ast-cli: Auto-update downloads are not verified against a checksum before execution",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-77157",
"datePublished": "2026-10-22T17:50:51.933Z",
"dateReserved": "2026-08-20T14:34:06.113Z",
"dateUpdated": "2026-10-22T17:50:51.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77156 (GCVE-0-2026-77156)
Vulnerability from nvd – Published: 2026-10-22 17:44 – Updated: 2026-10-22 17:49
VLAI
EPSS
VEX
Title
ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory
Summary
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.
Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal.
Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.
Severity
6.4 (Medium)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Checkmarx/ast-cli | product |
| https://github.com/Checkmarx/ast-cli/security/adv… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Checkmarx | github.com/checkmarx/ast-cli |
Affected:
0 , < 2.3.51
(semver)
Unaffected: 2.3.51 (semver) |
Date Public
2026-10-22 14:30
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://golang.org/pkg",
"defaultStatus": "unaffected",
"packageName": "github.com/checkmarx/ast-cli",
"platforms": [
"MacOS",
"Linux"
],
"product": "github.com/checkmarx/ast-cli",
"repo": "https://github.com/checkmarx/ast-cli",
"vendor": "Checkmarx",
"versions": [
{
"lessThan": "2.3.51",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.3.51",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Seb\u00e1stian Alba | @Sebasteuo"
}
],
"datePublic": "2026-10-22T14:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncomplete validation of extracted archive entry paths in ast-cli\u0027s tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.\u003c/p\u003e\u003cp\u003e\u003cspan\u003eExploitation required substituting the archive served at \"download.checkmarx.com\". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary\u0026nbsp;\u003c/span\u003e\u003cspan\u003efilesystem paths via this path traversal.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eExtraction now validates that each entry\u0027s destination path resolves within the working directory and rejects absolute paths.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "Incomplete validation of extracted archive entry paths in ast-cli\u0027s tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.\n\n\n\nExploitation required substituting the archive served at \"download.checkmarx.com\". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary\u00a0filesystem paths via this path traversal.\n\n\n\nExtraction now validates that each entry\u0027s destination path resolves within the working directory and rejects absolute paths."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T17:49:25.326Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/Checkmarx/ast-cli"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/Checkmarx/ast-cli/security/advisories/GHSA-9gff-3q53-q75x"
}
],
"source": {
"advisory": "GHSA-9gff-3q53-q75x",
"discovery": "EXTERNAL"
},
"title": "ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-77156",
"datePublished": "2026-10-22T17:44:34.313Z",
"dateReserved": "2026-08-20T14:34:04.801Z",
"dateUpdated": "2026-10-22T17:49:25.326Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2014-8778 (GCVE-0-2014-8778)
Vulnerability from nvd – Published: 2015-09-16 18:00 – Updated: 2024-08-06 13:26
VLAI
EPSS
VEX
Summary
Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Permissions.PermissionState.Unrestricted or (2) System.Security.Permissions.SecurityPermissionFlag.AllFlags permission.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://packetstormsecurity.com/files/133437/Check… | x_refsource_MISC |
| http://www.securityfocus.com/archive/1/536387/100… | mailing-listx_refsource_BUGTRAQ |
| http://seclists.org/fulldisclosure/2015/Sep/17 | mailing-listx_refsource_FULLDISC |
Date Public
2015-09-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:26:02.897Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/133437/Checkmarx-CxQL-7.1.5-Sandbox-Bypass.html"
},
{
"name": "20150903 Checkmarx CxQL Sandbox bypass (CVE-2014-8778)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/536387/100/0/threaded"
},
{
"name": "20150907 Checkmarx CxQL Sandbox bypass (CVE-2014-8778)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2015/Sep/17"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-09-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Permissions.PermissionState.Unrestricted or (2) System.Security.Permissions.SecurityPermissionFlag.AllFlags permission."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/133437/Checkmarx-CxQL-7.1.5-Sandbox-Bypass.html"
},
{
"name": "20150903 Checkmarx CxQL Sandbox bypass (CVE-2014-8778)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/536387/100/0/threaded"
},
{
"name": "20150907 Checkmarx CxQL Sandbox bypass (CVE-2014-8778)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2015/Sep/17"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-8778",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Permissions.PermissionState.Unrestricted or (2) System.Security.Permissions.SecurityPermissionFlag.AllFlags permission."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/133437/Checkmarx-CxQL-7.1.5-Sandbox-Bypass.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/133437/Checkmarx-CxQL-7.1.5-Sandbox-Bypass.html"
},
{
"name": "20150903 Checkmarx CxQL Sandbox bypass (CVE-2014-8778)",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/536387/100/0/threaded"
},
{
"name": "20150907 Checkmarx CxQL Sandbox bypass (CVE-2014-8778)",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2015/Sep/17"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-8778",
"datePublished": "2015-09-16T18:00:00.000Z",
"dateReserved": "2014-11-13T00:00:00.000Z",
"dateUpdated": "2024-08-06T13:26:02.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-77157 (GCVE-0-2026-77157)
Vulnerability from cvelistv5 – Published: 2026-10-22 17:50 – Updated: 2026-10-22 17:50
VLAI
EPSS
VEX
Title
ast-cli: Auto-update downloads are not verified against a checksum before execution
Summary
ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime".
Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute the contents of the archive, since no integrity check was performed on the download.
Successful exploitation requires compromising "download.checkmarx.com" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx's VSCode/JetBrains extensions) or cx scan "sca-realtime" on an affected version would have extracted and executed that binary in place of the intended download.
The download is now verified against a published SHA-256 checksum before extraction.
Severity
6.4 (Medium)
CWE
- CWE-353 - Missing support for integrity check
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Checkmarx/ast-cli | product |
| https://github.com/Checkmarx/ast-cli/security/adv… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Checkmarx | github.com/checkmarx/ast-cli |
Affected:
0 , ≤ 2.3.59
(semver)
Unaffected: 2.3.60 (semver) |
Date Public
2026-10-19 23:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://golang.org/pkg",
"defaultStatus": "unaffected",
"packageName": "github.com/checkmarx/ast-cli",
"product": "github.com/checkmarx/ast-cli",
"repo": "https://github.com/checkmarx/ast-cli",
"vendor": "Checkmarx",
"versions": [
{
"lessThanOrEqual": "2.3.59",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.3.60",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Seb\u00e1stian Alba | @Sebasteuo"
}
],
"datePublic": "2026-10-19T23:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003east-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from \"download.checkmarx.com\" as part of its auto-update flow, triggered by the Checkmarx\u2019s \"VSCode/JetBrains\" extensions and by cx scan \"sca-realtime\".\u003c/p\u003e\u003cp\u003ePrior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract\u0026nbsp;\u003cspan\u003eand execute the contents of the archive, since no integrity check was performed on\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe download.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eSuccessful exploitation requires compromising \"download.checkmarx.com\" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx\u0027s VSCode/JetBrains extensions) or cx scan \"sca-realtime\" on an affected version would have extracted and executed that binary in place of the intended download.\u003cspan\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003eThe download is now verified against a published SHA-256 checksum before extraction.\u003c/p\u003e"
}
],
"value": "ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from \"download.checkmarx.com\" as part of its auto-update flow, triggered by the Checkmarx\u2019s \"VSCode/JetBrains\" extensions and by cx scan \"sca-realtime\".\n\n\n\nPrior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract\u00a0and execute the contents of the archive, since no integrity check was performed on\u00a0the download.\n\n\n\nSuccessful exploitation requires compromising \"download.checkmarx.com\" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx\u0027s VSCode/JetBrains extensions) or cx scan \"sca-realtime\" on an affected version would have extracted and executed that binary in place of the intended download.\n\n\n\nThe download is now verified against a published SHA-256 checksum before extraction."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-353",
"description": "CWE-353 Missing support for integrity check",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T17:50:51.933Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/Checkmarx/ast-cli"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/Checkmarx/ast-cli/security/advisories/GHSA-vf6p-x2fw-5hcg"
}
],
"source": {
"advisory": "GHSA-vf6p-x2fw-5hcg",
"discovery": "EXTERNAL"
},
"title": "ast-cli: Auto-update downloads are not verified against a checksum before execution",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-77157",
"datePublished": "2026-10-22T17:50:51.933Z",
"dateReserved": "2026-08-20T14:34:06.113Z",
"dateUpdated": "2026-10-22T17:50:51.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77156 (GCVE-0-2026-77156)
Vulnerability from cvelistv5 – Published: 2026-10-22 17:44 – Updated: 2026-10-22 17:49
VLAI
EPSS
VEX
Title
ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory
Summary
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.
Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal.
Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.
Severity
6.4 (Medium)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Checkmarx/ast-cli | product |
| https://github.com/Checkmarx/ast-cli/security/adv… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Checkmarx | github.com/checkmarx/ast-cli |
Affected:
0 , < 2.3.51
(semver)
Unaffected: 2.3.51 (semver) |
Date Public
2026-10-22 14:30
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://golang.org/pkg",
"defaultStatus": "unaffected",
"packageName": "github.com/checkmarx/ast-cli",
"platforms": [
"MacOS",
"Linux"
],
"product": "github.com/checkmarx/ast-cli",
"repo": "https://github.com/checkmarx/ast-cli",
"vendor": "Checkmarx",
"versions": [
{
"lessThan": "2.3.51",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.3.51",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Seb\u00e1stian Alba | @Sebasteuo"
}
],
"datePublic": "2026-10-22T14:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncomplete validation of extracted archive entry paths in ast-cli\u0027s tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.\u003c/p\u003e\u003cp\u003e\u003cspan\u003eExploitation required substituting the archive served at \"download.checkmarx.com\". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary\u0026nbsp;\u003c/span\u003e\u003cspan\u003efilesystem paths via this path traversal.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eExtraction now validates that each entry\u0027s destination path resolves within the working directory and rejects absolute paths.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "Incomplete validation of extracted archive entry paths in ast-cli\u0027s tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.\n\n\n\nExploitation required substituting the archive served at \"download.checkmarx.com\". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary\u00a0filesystem paths via this path traversal.\n\n\n\nExtraction now validates that each entry\u0027s destination path resolves within the working directory and rejects absolute paths."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T17:49:25.326Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/Checkmarx/ast-cli"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/Checkmarx/ast-cli/security/advisories/GHSA-9gff-3q53-q75x"
}
],
"source": {
"advisory": "GHSA-9gff-3q53-q75x",
"discovery": "EXTERNAL"
},
"title": "ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-77156",
"datePublished": "2026-10-22T17:44:34.313Z",
"dateReserved": "2026-08-20T14:34:04.801Z",
"dateUpdated": "2026-10-22T17:49:25.326Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2014-8778 (GCVE-0-2014-8778)
Vulnerability from cvelistv5 – Published: 2015-09-16 18:00 – Updated: 2024-08-06 13:26
VLAI
EPSS
VEX
Summary
Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Permissions.PermissionState.Unrestricted or (2) System.Security.Permissions.SecurityPermissionFlag.AllFlags permission.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://packetstormsecurity.com/files/133437/Check… | x_refsource_MISC |
| http://www.securityfocus.com/archive/1/536387/100… | mailing-listx_refsource_BUGTRAQ |
| http://seclists.org/fulldisclosure/2015/Sep/17 | mailing-listx_refsource_FULLDISC |
Date Public
2015-09-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:26:02.897Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/133437/Checkmarx-CxQL-7.1.5-Sandbox-Bypass.html"
},
{
"name": "20150903 Checkmarx CxQL Sandbox bypass (CVE-2014-8778)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/536387/100/0/threaded"
},
{
"name": "20150907 Checkmarx CxQL Sandbox bypass (CVE-2014-8778)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2015/Sep/17"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-09-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Permissions.PermissionState.Unrestricted or (2) System.Security.Permissions.SecurityPermissionFlag.AllFlags permission."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/133437/Checkmarx-CxQL-7.1.5-Sandbox-Bypass.html"
},
{
"name": "20150903 Checkmarx CxQL Sandbox bypass (CVE-2014-8778)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/536387/100/0/threaded"
},
{
"name": "20150907 Checkmarx CxQL Sandbox bypass (CVE-2014-8778)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2015/Sep/17"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-8778",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Permissions.PermissionState.Unrestricted or (2) System.Security.Permissions.SecurityPermissionFlag.AllFlags permission."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/133437/Checkmarx-CxQL-7.1.5-Sandbox-Bypass.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/133437/Checkmarx-CxQL-7.1.5-Sandbox-Bypass.html"
},
{
"name": "20150903 Checkmarx CxQL Sandbox bypass (CVE-2014-8778)",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/536387/100/0/threaded"
},
{
"name": "20150907 Checkmarx CxQL Sandbox bypass (CVE-2014-8778)",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2015/Sep/17"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-8778",
"datePublished": "2015-09-16T18:00:00.000Z",
"dateReserved": "2014-11-13T00:00:00.000Z",
"dateUpdated": "2024-08-06T13:26:02.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}