CVE-2026-77157

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77157
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77157.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77157
Aliases
  • GHSA-vf6p-x2fw-5hcg
Published
2026-10-22T17:50:51Z
Modified
2026-10-23T02:45:23Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
ast-cli: Auto-update downloads are not verified against a checksum before execution
Details

ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime".

Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute the contents of the archive, since no integrity check was performed on the download.

Successful exploitation requires compromising "download.checkmarx.com" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx's VSCode/JetBrains extensions) or cx scan "sca-realtime" on an affected version would have extracted and executed that binary in place of the intended download.

The download is now verified against a published SHA-256 checksum before extraction.

Database specific 
{
    "cna_assigner":  "Checkmarx",
    "cwe_ids":  [
        "CWE-353"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77157.json"
}
References

Affected packages

Git / github.com/checkmarx/ast-cli

Affected ranges

Type
GIT
Repo
https://github.com/checkmarx/ast-cli
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
27d93f436c11a4dac797ea77f4c2d9e19db650c2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "2.3.59"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

1.*
1.0.0_RC5
1.0.65
1.1.1-test-sonar
2.*
2.0.0
2.0.0-nightly
2.0.0-rc.14
2.0.0-rc.16
2.0.0-rc.19
2.0.0-rc.20
2.0.0-rc.21
2.0.0-rc.22
2.0.0-rc.23
2.0.0_RC1
2.0.0_RC10
2.0.0_RC11
2.0.0_RC12
2.0.0_RC13
2.0.0_RC2
2.0.0_RC4
2.0.0_RC5
2.0.0_RC6
2.0.0_RC7
2.0.0_RC8
2.0.0_RC9
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.25
2.0.26
2.0.27
2.0.28
2.0.29
2.0.3
2.0.30
2.0.31
2.0.32
2.0.33
2.0.34
2.0.35
2.0.36
2.0.37
2.0.38
2.0.39
2.0.4
2.0.40
2.0.41
2.0.42
2.0.43
2.0.44
2.0.45
2.0.46
2.0.47
2.0.48
2.0.49
2.0.5
2.0.50
2.0.51
2.0.52
2.0.53
2.0.54
2.0.55
2.0.56
2.0.57
2.0.58
2.0.59
2.0.6
2.0.60
2.0.61
2.0.62
2.0.63
2.0.64
2.0.64-sast-chat
2.0.65
2.0.66
2.0.67
2.0.68
2.0.69
2.0.7
2.0.7-PreRelease
2.0.71
2.0.72
2.0.72-prerelease
2.0.73
2.0.73-prerelease
2.0.74
2.0.75
2.0.75-pre-tamar
2.0.75-prerelease
2.0.76
2.0.76-Pre-release
2.0.76-prerelease-2
2.0.8
2.0.9
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6-check-pre-release
2.2.6-vorpal
2.3.10
2.3.11
2.3.12
2.3.13
2.3.14
2.3.15
2.3.15-cloudscan
2.3.16
2.3.16-test
2.3.17
2.3.17-test
2.3.18
2.3.19
2.3.19-traits
2.3.20
2.3.20-remove-ignore-policy
2.3.21
2.3.22
2.3.23
2.3.23-test-oss
2.3.24
2.3.25
2.3.26
2.3.27
2.3.27-Containers.1
2.3.27-MiryamFoifer-Containers
2.3.27-cloud-scan-containers
2.3.28
2.3.29
2.3.29-containers-upgrade
2.3.29-containers-upgrade-01
2.3.30
2.3.30-containers-upgrade
2.3.31
2.3.31-iac-realtime
2.3.32
2.3.32-Remove-filePath-ignore-Final
2.3.33
2.3.34
2.3.35
2.3.36
2.3.36-pre-release-check
2.3.37
2.3.38
2.3.38-iac-realtime
2.3.38-standalone-license-enabled
2.3.41
2.3.42
2.3.43
2.3.43-iac-main-release
2.3.44
2.3.45
2.3.46
2.3.47
2.3.48
2.3.51
2.3.52
2.3.53
2.3.54
2.3.54-claude-cli2-prerelease
2.3.55
2.3.56
2.3.57
2.3.58
2.3.58-prerelease
2.3.59-Cursor-CLI
2.4.0-TempCleanup
Other
TempCleanup
application-association-prerelease
cli-pre-commit
custom-config-file-main
prerelease-releasefix
standalone-licence-info
test-oss
test-pre
test-sonar
try-pre-release
try-pre-release-tamar
v1.*
v1.0.0
v1.0.0_RC1
v1.0.0_RC2
v1.0.0_RC3
v1.0.0_RC4
v1.10.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77157.json"