Skip to content
Heist/ feed
Medium

ast-cli: Auto-update downloads are not verified against a checksum before execution

Type: advisorySource: Official CVE List1 source record

ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute the contents of the archive, since no integrity check was performed on the download. Successful exploitation requires compromising "download.checkmarx.com" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx's VSCode/JetBrains extensions) or cx scan "sca-realtime" on an affected version would have extracted and executed that binary in place of the intended download. The download is now verified against a published SHA-256 checksum before extraction.

Announced Source revision 1
Original source ↗

CVE-2026-77157

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-77157

github.com/checkmarx/ast-cli

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://github.com/checkmarx/ast-cli",
    "vendor": "Checkmarx",
    "product": "github.com/checkmarx/ast-cli",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "2.3.59"
      },
      {
        "status": "unaffected",
        "version": "2.3.60",
        "versionType": "semver"
      }
    ],
    "packageName": "github.com/checkmarx/ast-cli",
    "collectionURL": "https://golang.org/pkg",
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-77157

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#50518 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement