Checkmarx vulnerabilities

Products

• github.com/checkmarx/ast-cli 2
• cxsast 1

Latest Checkmarx CVEs

Newest publication first

1. CVE-2026-77157 ast-cli: Auto-update downloads are not verified against a checksum before execution

   Published 2026-10-22

   Medium·CVSS 6.3 EPSS 0.14%

   ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded...

2. CVE-2026-77156 ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory

   Published 2026-10-22

   Medium·CVSS 6.3 EPSS 0.35%

   Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write file...

3. CVE-2014-8778 Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Pe...

   Published 2015-09-16

   High·CVSS 9.0 EPSS 3.3%

   Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Permissions.PermissionState.Unrestricted or (2) System.Security.Permissions.Securi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.