Threats Tagged 'cve-2025-12999'
View all threats tagged with 'cve-2025-12999'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2025-12999'
Click on any threat for detailed analysis and mitigation recommendations
CVE-2025-12999 is a critical vulnerability in Eclipse Open VSX affecting versions from 0.6.0 up to and including 1.1.2. The vulnerability arises because the application builds absolute URLs in responses from client-supplied X-Forwarded headers without verifying if the sender is a trusted proxy. These responses are cached without including the host in the cache key, allowing an attacker to poison the cache with malicious URLs. This can lead to downstream VS Code-compatible editors fetching and installing malicious VSIX packages. Exploitability depends on deployment topology, specifically whether the server is directly reachable or fronted by a proxy that relays these headers. Workarounds include configuring the proxy to overwrite these headers, restricting direct server access, and flushing caches after configuration changes. Join the discussion | CVE Database V5 | 09/21/2026, 08:59:00 UTC Added: 09/21/2026, 14:02:28 UTC |
Showing 1 to 1 of 1 result