github.com/checkmarx/ast-cli vulnerabilities
CVEs whose affected-version data names the github.com/checkmarx/ast-cli package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-77157Medium· 6.4ast-cli: Auto-update downloads are not verified against a checksum before execution
ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-r…
▾ SunlitCheckmarx · github.com/checkmarx/ast-clivia CVEORG
CVE-2026-77156Medium· 6.4ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absol…
▾ SunlitCheckmarx · github.com/checkmarx/ast-clivia CVEORG