ast-cli: Auto-update downloads are not verified against a checksum before execution
Summary
| CVE | CVE-2026-77157 |
|---|---|
| State | PUBLISHED |
| Assigner | Checkmarx |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-22 18:17:29 UTC |
| Updated | 2026-10-22 18:17:29 UTC |
| Description | ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute the contents of the archive, since no integrity check was performed on the download. Successful exploitation requires compromising "download.checkmarx.com" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx's VSCode/JetBrains extensions) or cx scan "sca-realtime" on an affected version would have extracted and executed that binary in place of the intended download. The download is now verified against a published SHA-256 checksum before extraction. |
Risk And Classification
Primary CVSS: v4.0 6.3 MEDIUM from 596c5446-0ce5-4ba2-aa66-48b3b757a647
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-353 | CWE-353 CWE-353 Missing support for integrity check
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 596c5446-0ce5-4ba2-aa66-48b3b757a647 | Secondary | 6.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/C... |
| 4.0 | CNA | CVSS | 6.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H |
| 3.1 | 596c5446-0ce5-4ba2-aa66-48b3b757a647 | Secondary | 6.4 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 6.4 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
HighUser Interaction
PassiveConfidentiality
NoneIntegrity
NoneAvailability
NoneSub Conf.
HighSub Integrity
HighSub Availability
HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
HighUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Checkmarx | Github.com/checkmarx/ast-cli | affected 2.3.59 semver | Not specified |
| CNA | Checkmarx | Github.com/checkmarx/ast-cli | unaffected 2.3.60 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/Checkmarx/ast-cli/security/advisories/GHSA-vf6p-x2fw-5hcg | 596c5446-0ce5-4ba2-aa66-48b3b757a647 | github.com | |
| github.com/Checkmarx/ast-cli | 596c5446-0ce5-4ba2-aa66-48b3b757a647 | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Sebástian Alba | @Sebasteuo (en)
There are currently no legacy QID mappings associated with this CVE.