CVE-2025-6705: High severity Eclipse Open VSX Registry vulnerability
A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’s build scripts were executed without proper isolation, potentially exposing a privileged token. This token enabled the publishing of new extension versions under any namespace, including those not controlled by an attacker. However, it did not permit deletion of existing extensions, overwriting of published versions, or access to administrative features of the registry.
The issue was reported on May 4, 2025, fully resolved by June 24, and followed by a comprehensive audit. No evidence of compromise was found, though 81 extensions were proactively deactivated as a precaution. The standard publishing process remained unaffected. Recommendations have been issued to mitigate similar risks in the future.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Because the automated publishing build scripts were executed without proper isolation and potentially exposed a privileged token, ensure the publishing/build scripts run in properly isolated execution environments to prevent token exposure (e.g., isolate build execution and restrict token access to only what is required during publishing).
- Operational
Proactively deactivate extensions affected by (or potentially related to) the automated publishing risk; the incident response deactivated 81 extensions as a precaution.
- Operational
After the comprehensive audit (reported May 4, 2025 and resolved June 24, 2025), verify token and publishing credentials are still valid for the registry publishing pipeline and rotate/recreate any privileged tokens that may have been exposed, since the token could publish new extension versions under any namespace.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6705?
CVE-2025-6705 is considered to have a critical severity due to the potential for unauthorized users to execute arbitrary scripts.
How do I fix CVE-2025-6705?
To fix CVE-2025-6705, ensure that you are using the updated version of Open VSX where the sandboxing issue has been addressed.
What vulnerabilities does CVE-2025-6705 exploit?
CVE-2025-6705 exploits the lack of sandboxing in CI job runs, allowing arbitrary build scripts to be executed.
Who is affected by CVE-2025-6705?
Any service account associated with Open VSX extensions that have not been properly secured can be affected by CVE-2025-6705.
How can an attacker leverage CVE-2025-6705?
An attacker can leverage CVE-2025-6705 by gaining access to an existing extension and running malicious scripts that compromise the service account.