Ast‑CLI automatically downloads two helper binaries, the Vorpal ASCA real‑time engine and the SCA Resolver, from download.checkmarx.com during its auto‑update process. Prior to the fix, the client did not verify the archive against a checksum before extracting and executing its contents. This missing integrity check means an attacker who can replace the served archive with one containing an arbitrary binary would be able to cause ast‑CLI to execute that binary on the developer’s machine or on a CI pipeline, leading to remote code execution. The weakness is related to improper checksum verification (CWE‑353).

Affected systems include Checkmarx’s ast‑CLI tool distributed from github.com/checkmarx/ast-cli. The vulnerability exists in all releases prior to the patch that added checksum verification; no specific affected version numbers are listed in the advisory.

The vulnerability has a CVSS score of 6.3, indicating moderate complexity and impact. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires compromise of the Checkmarx download server or related infrastructure, as the attacker must replace the archive served from download.checkmarx.com. The likely attack vector is therefore a supply‑chain compromise or DNS tampering affecting the download host. For environments that cannot immediately apply the patch, the risk remains moderate until the integrity check is restored.