The Open VSX Registry component of Eclipse Open VSX fails to sanitize SVG files uploaded as extension icons before storage and serves them with Content-Type: image/svg+xml without security headers such as Content-Security-Policy or Content-Disposition: attachment. This improper neutralization of input leads to stored cross-site scripting (CWE-79). When a user navigates directly to the malicious SVG icon URL, script execution occurs. In local storage deployments, the script runs within the Open VSX application origin, enabling session hijacking, authentication token theft, and unauthorized extension publishing. In deployments backed by external storage (e.g., S3-backed CDN like open-vsx.org), script execution is confined to the storage origin, reducing impact but still allowing phishing and credential harvesting. The vulnerability affects versions =0.1.0 and >=0.1.0 <0.34.1. The product is a cloud service, and the vendor manages remediation. No known exploits are reported in the wild.

Exploitation of this vulnerability allows attackers to execute stored cross-site scripting attacks via malicious SVG icons in extensions. On local storage deployments, this can lead to session hijacking, theft of authentication tokens, and unauthorized publishing of extensions. On external storage deployments, the impact is limited to the storage origin, but attackers can still conduct phishing attacks and harvest credentials through crafted pages. The CVSS v3.1 base score is 4.1 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and limited impact on integrity without confidentiality or availability loss.

Since Eclipse Open VSX is a cloud service, the vendor manages remediation server-side. A patch is available for affected versions. Users and administrators should ensure they are using a patched version (>=0.34.1) or rely on the vendor's updated cloud service. No additional user action is required if using the vendor-hosted service. For self-hosted deployments, upgrade to the fixed version to mitigate the vulnerability.