The Code Extension Marketplace (coder/code-marketplace) before version 2.4.2 contains a Zip Slip vulnerability (CWE-22) in its ExtractZip function. This function passed raw zip entry names to a callback that wrote files using filepath.Join without enforcing boundary checks. Although filepath.Join resolves '..' components, it does not prevent the resulting path from escaping the base directory, enabling an attacker to write files outside the intended extension directory. This vulnerability allows arbitrary file write via a crafted VSIX archive. The issue is fixed in version 2.4.2.

Exploitation of this vulnerability allows an unauthenticated attacker to write arbitrary files outside the extension directory by crafting a malicious VSIX file. This can lead to unauthorized file modification or creation on the host system, potentially enabling further compromise depending on the environment and file targets. The CVSS 4.0 score of 8.7 reflects high severity due to network attack vector, no required privileges or user interaction, and high impact on integrity.

This vulnerability is fixed in coder/code-marketplace version 2.4.2. Users and administrators should upgrade to version 2.4.2 or later to remediate this issue. Patch status is not explicitly confirmed in the vendor advisory content provided, but the description states the vulnerability is fixed in 2.4.2. No additional mitigation steps are indicated.