The vulnerability lies in the way the application constructs absolute URLs for assets, download links and keys using the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix headers without validating that these headers come from a trusted reverse proxy. An attacker can send requests with forged headers, causing the server to generate URLs that point to malicious locations. Because those URLs are cached, every other client that retrieves the cached metadata will be instructed to download a malicious VSIX, sign it with a forged signature, and use a fabricated public key, allowing the attacker to deliver arbitrary code to those clients. This leads to remote code execution on machines that download the poisoned extension. The weakness is a form of input validation error that permits cache poisoning and unsanitized header usage.

The affected product is Eclipse Open VSX provided by the Eclipse Foundation. The vulnerability applies to any deployed instance of this service that accepts client‑supplied X‑Forwarded-Host, X‑Forwarded-Proto or X‑Forwarded‑Prefix values without filtering them, including versions before any fix is released. Exact affected version numbers are not provided in the advisory.

The CVSS score of 9.1 indicates a high‑severity vulnerability. The exploit confidence is moderate because it requires direct or proxy‑assisted HTTP access to the Open VSX service; a proxy that rewrites the forwarded headers mitigates the risk. The vulnerability is not yet listed in the CISA KEV catalog. An unauthenticated attacker can induce cache poisoning and trigger remote code execution by crafting a single HTTP request, so the risk is significant for environments with publicly reachable Open VSX instances.