CVE-2026-77157

MediumCVSS 6.4

Published: 22/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

ast-cli downloads two helper binaries, the Vorpal ASCA engine and the SCA Resolver, from download.checkmarx.com as part of its auto-update flow, triggered by Checkmarx VSCode/JetBrains extensions and cx scan sca-realtime. Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute.

Risk Assessment

Exploitation requires compromising download.checkmarx.com, but on success any developer machine or CI pipeline invoking ASCA or sca-realtime would execute the malicious binary.

Recommendation

Update ast-cli to a patched version that verifies the downloaded archive against a published SHA-256 checksum before extraction.

Other vulnerabilities in ast-cli

CVE-2026-77156Medium
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing Vorpal ASCA and SCA Resolver) allows a malicious tar archive with absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.

Original NVD description (English source)

ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute the contents of the archive, since no integrity check was performed on the download. Successful exploitation requires compromising "download.checkmarx.com" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx's VSCode/JetBrains extensions) or cx scan "sca-realtime" on an affected version would have extracted and executed that binary in place of the intended download. The download is now verified against a published SHA-256 checksum before extraction.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS