CVE-2025-12999
Description
A flaw was found in openvsx-server. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution on client machines through HTTP cache poisoning. The server generates download and verification URLs from untrusted proxy headers, such as X-Forwarded-Host, without validating the sender. Because these responses are cached across clients, an attacker can poison the metadata cache to serve malicious extensions and verification keys to downstream users.
Statement
This flaw is rated Critical because it lets an unauthenticated remote attacker run code inside the workspace of a Dev Spaces user, and the preconditions hold in a default installation. Both preconditions were confirmed on a running default Dev Spaces 3.x install by Dev Spaces engineering: the plugin registry search endpoint answers 200 without login, and a client-supplied X-Forwarded-Host reaches the Open VSX server unmodified because the ingress proxy appends the real host as a second header value while the server reads the first one.
The Open VSX server embedded in the plugin registry builds extension download, signature, and public key URLs from that unvalidated header, and caches those responses per extension. One crafted request fixes the URLs every other client gets for the next hour. Since the attacker controls the package, signature, and key together, signature verification does not help.
The only bounding condition is the cache entry being empty when the poisoned request arrives; it recurs hourly. Dev Spaces 3.28, 3.29 and 3.30 ship affected versions (0.34.5, 1.0.1, 1.1.1; fixed in 1.2.0). Fixes are released only for the current minor version, so 3.30 receives the fix in a z-stream update while 3.28 and 3.29 will not receive one. Customers on 3.28 or 3.29 should upgrade to 3.30 to get the fix.
Mitigation
On installations that cannot upgrade to a fixed version yet, reconfigure the proxy in front of the Open VSX server to set X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix to known values instead of relaying client input, and make sure the server is not reachable except through that proxy. Existing poisoned cache entries survive the configuration change, so flush the Open VSX caches afterwards.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
