The vulnerability results from an unchecked Zip Slip condition when installing extensions. A malicious VSIX file can write files outside the intended extension directory, enabling the creation or overwrite of arbitrary files. This may lead to tampering of critical system files, paving the way for further compromise or denial of service. The weakness corresponds to path traversal (CWE‑22).

The Code Extension Marketplace, maintained by coder, is the affected product. All releases prior to 2.4.2 are vulnerable; users and organizations deploying the marketplace should determine if they are running v2.4.1 or older and plan to upgrade. The marketplace serves as an open‑source alternative to the VS Code Marketplace and is commonly used in development environments.

With a CVSS score of 8.7, the vulnerability is considered high severity. No EPSS data is available, and it is not listed in CISA's KEV catalog, limiting published exploit probability details. The attack requires submission of a malicious VSIX package to the marketplace. Once the package is processed, the attacker can write or overwrite files outside the extension directory, potentially reaching privileged files and compromising the host. Consequently, the risk to systems that accept extensions from untrusted sources is significant.