The Code Extension Marketplace (coder/code-marketplace) before version 2.4.2 contains a Zip Slip vulnerability (CWE-22) that allows an attacker to craft a malicious VSIX archive with path traversal sequences. When extracted, the vulnerable ExtractZip function uses filepath.Join to write files but does not enforce boundary checks to prevent escaping the base extension directory. This allows arbitrary file write outside the intended directory, potentially leading to code execution or system compromise. The vulnerability is addressed in version 2.4.2.

Successful exploitation allows an unauthenticated attacker to write arbitrary files outside the designated extension directory by exploiting path traversal in zip extraction. This can lead to overwriting critical files, potentially resulting in code execution or system compromise. The CVSS 4.0 score is 8.7 (high severity), reflecting the network attack vector, no required privileges or user interaction, and high impact on integrity.

This vulnerability is fixed in coder/code-marketplace version 2.4.2. Users should upgrade to version 2.4.2 or later to remediate this issue. No official patch or remediation level is explicitly stated beyond the version fix. Patch status is confirmed by the vendor's versioning information. Until upgrade, avoid installing untrusted VSIX extensions.