CVE-2026-77157: CWE-353 Missing support for integrity check in Checkmarx github.com/checkmarx/ast-cli

The ast-cli tool from Checkmarx downloads two helper binaries (Vorpal ASCA real-time engine and SCA Resolver) from download.checkmarx.com during its auto-update flow triggered by Checkmarx's VSCode/JetBrains extensions and cx scan 'sca-realtime'. Prior to the fix, these downloads were not verified against any checksum before extraction and execution, allowing an attacker who could replace the archive on the server to deliver arbitrary binaries. Successful exploitation requires compromising the download server to substitute the archive. The fix adds verification of the downloaded archive against a published SHA-256 checksum before extraction to prevent execution of tampered binaries.

If an attacker compromises the download.checkmarx.com server and replaces the helper binaries with malicious versions, any developer machine or CI pipeline invoking the affected ast-cli versions could execute arbitrary code. This impacts confidentiality, integrity, and availability as the attacker-controlled binary could perform any action with the privileges of the invoking user. The vulnerability requires high privileges to exploit (PR:H) and user interaction (UI:R), with network attack vector (AV:N).

A fix is available that adds SHA-256 checksum verification of the downloaded helper binaries before extraction and execution. Users should upgrade to a version later than 2.3.59 where this verification is implemented. Until upgraded, ensure the security of the download.checkmarx.com server and restrict access to prevent archive substitution.