Checkmarx github.com/checkmarx/ast-cli vulnerabilities

Latest Checkmarx github.com/checkmarx/ast-cli CVEs

Newest publication first

1. CVE-2026-77157 ast-cli: Auto-update downloads are not verified against a checksum before execution

   Published 2026-10-22

   Medium·CVSS 6.3

   ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded...

2. CVE-2026-77156 ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory

   Published 2026-10-22

   Medium·CVSS 6.3

   Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write file...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.