CVE-2026-77157: ast-cli: Auto-update downloads are not verified against a checksum before execution

Published Oct 22, 2026

Updated

ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime".

Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute the contents of the archive, since no integrity check was performed on the download.

Successful exploitation requires compromising "download.checkmarx.com" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx's VSCode/JetBrains extensions) or cx scan "sca-realtime" on an affected version would have extracted and executed that binary in place of the intended download.

The download is now verified against a published SHA-256 checksum before extraction.

Affected Software

1 affected component

Checkmarx ast-cli

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Verify the SHA-256 checksum of ast-cli's downloaded Vorpal ASCA real-time engine and SCA Resolver archives against the published checksum before extraction and execution.

Event History

Oct 22, 2026

CVE Published

via MITRE·05:50 PM

Data Sourced

via MITRE·05:50 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Developer workstations and CI pipelines using an affected ast-cli version are exposed when they invoke ASCA through the Checkmarx VSCode or JetBrains extensions, or run cx scan sca-realtime. Systems that do not trigger this auto-update flow are not described as affected.

What would an attacker need to exploit it?

The attacker would need to compromise download.checkmarx.com and replace the served helper archive with one containing an attacker-controlled binary. Exploitation also depends on an affected client downloading that substituted archive through the relevant auto-update flow.

How can teams determine whether they may already have been affected?

Teams should identify developer machines and CI pipelines that invoked ASCA through the Checkmarx IDE extensions or ran cx scan sca-realtime while using an affected version. The provided information does not include indicators for determining whether a malicious archive was actually served or executed.

What changed in the fix?

Downloaded archives are now verified against a published SHA-256 checksum before they are extracted. This prevents execution when the downloaded archive does not match the expected checksum.

CVE-2026-77157: ast-cli: Auto-update downloads are not verified against a checksum before execution

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What would an attacker need to exploit it?

How can teams determine whether they may already have been affected?

What changed in the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What would an attacker need to exploit it?

How can teams determine whether they may already have been affected?

What changed in the fix?