Open VSX 1.2.0 Blocks Marketplace Cache Poisoning
Tech GuruQuick Answer
GHSA-f55q-5m46-rmxc describes cache poisoning in Open VSX server releases from 0.6.0 up to, but not including, 1.2.0, including the listed container distributions. The attack requires a deployment that trusts attacker-controlled forwarded-host data and an unpopulated cache entry. Open VSX 1.2.0 is the listed fix.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Open VSX server, Docker, and GHCR packages from 0.6.0 before 1.2.0, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-09-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Open VSX server, Docker, and GHCR packages from 0.6.0 before 1.2.0 |
|---|---|
| Advisory | GHSA-f55q-5m46-rmxc |
| CVE | CVE-2025-12999 |
| Authoritative release date | 2026-09-21 07:43:23 UTC |
| Authority revision date | 2026-09-21 07:43:23 UTC |
| Affected versions | Open VSX server, Docker, and GHCR packages from 0.6.0 before 1.2.0 |
| Fixed version | Open VSX 1.2.0 |
| CVSS base score | 9.1 (CVSS v4.0) |
| CVSS severity | Critical |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The affected route is /vscode/gallery/{namespace}/{extension}/latest. When attacker-controlled forwarded-host data is trusted, it can poison a previously unpopulated ('cold') marketplace cache entry. The advisory's takeover label is conditional on that trust and cache state; the version range alone does not prove that the deployment meets both conditions.
What To Validate Now
- Inventory. Locate Open VSX server, Docker, and GHCR packages from 0.6.0 before 1.2.0 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Confirm the Open VSX server version and the proxy/header trust configuration. Assess whether an attacker can control the forwarded host and reach a cold cache entry; do not equate an ordinary extension installation with operating the affected server.
- Remediate. Apply Open VSX 1.2.0 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Verify the deployed server or container version and approved marketplace requests through the actual proxy path. Review forwarded-host handling and relevant cache/request evidence before declaring the exposure resolved.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
