CVE-2026-4983: XSS
Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security headers such as Content-Security-Policy or Content-Disposition: attachment. This allows an attacker to publish an extension with a malicious SVG icon and achieve stored cross-site scripting (XSS) when a user navigates directly to the icon URL.
On deployments using local storage, script execution occurs within the Open VSX application origin, enabling session hijacking, authentication token theft, and unauthorized extension publishing. On deployments backed by external storage (such as open-vsx.org with an S3-backed CDN), execution is confined to the storage origin, reducing impact but still permitting phishing attacks and credential harvesting through attacker-crafted pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Serve SVG icon files with the HTTP header Content-Disposition: attachment to force download rather than in-browser rendering of the SVG.
Open VSX Registry HTTP responses for extension icons Content-Disposition = attachment - Configuration
Sanitize uploaded SVG files prior to storage: remove <script> elements, on* event handler attributes, external resource references and other active content before saving icons.
Open VSX Registry (icon upload pipeline) svg_sanitization = enabled - Compensating control
Serve extension SVG icon responses with a restrictive Content-Security-Policy that prevents script execution and loading of external resources for SVG responses (i.e., add a CSP on SVG responses to disallow scripts and external sources).
- Operational
Locate existing stored SVG icon files in the registry/storage, and re-scan each file; sanitize or remove any SVGs containing scripts or active content and replace with sanitized copies or remove the icon completely.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4983?
CVE-2026-4983 has a medium severity rating of 4.1.
What type of vulnerability is represented by CVE-2026-4983?
CVE-2026-4983 is classified as an XSS (Cross-Site Scripting) vulnerability.
How does CVE-2026-4983 impact the Open VSX Registry?
CVE-2026-4983 allows attackers to upload malicious SVG files as extension icons, potentially enabling code execution.
How can I mitigate CVE-2026-4983?
Mitigating CVE-2026-4983 involves sanitizing uploaded SVG files and implementing appropriate security headers.
What is the vector for exploitation in CVE-2026-4983?
CVE-2026-4983 can be exploited remotely through the upload of unvalidated SVG files.