Skip to content
OpenAdvisories

Product · Checkmarx

github.com/checkmarx/ast-cli

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-77157

    ast-cli: Auto-update downloads are not verified against a checksum before execution

    ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the…

    Checkmarx github.com/checkmarx/ast-cli
  • Medium 6.4
    CVE-2026-77156

    ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory

    Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path …

    Checkmarx github.com/checkmarx/ast-cli