Threats affecting pkg:github/coder/code-marketplace

CVE-2026-35454 is a high-severity path traversal vulnerability in coder/code-marketplace versions prior to 2.4.2. The vulnerability, known as Zip Slip, allows a malicious VSIX file to write arbitrary files outside the intended extension directory. This occurs because the ExtractZip function passes raw zip entry names to a callback that writes files using filepath. Join without properly restricting the resulting path, enabling directory traversal via '.. ' components. The issue is fixed in version 2.4.2.