CVE-2026-22685: 
Homebrew vulnerability analysis and mitigation

CVE-2026-22685 is a path traversal ("Zip Slip") vulnerability in the DevToys desktop application's extension installation mechanism, affecting versions 2.0.0.0 through 2.0.8.x. When processing NUPKG extension archives, DevToys fails to sufficiently validate file paths within the archive, allowing a malicious package to write files outside the intended extensions directory. The vulnerability was disclosed on January 8, 2026, with a patch released the same day in version 2.0.9.0 (GitHub Advisory). The GitHub advisory assigns a CVSS v3.1 score of 8.8 (High) with user interaction required, while Feedly's estimate assigns 9.8 (Critical) with no user interaction (GitHub Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-23 (Relative Path Traversal), stemming from the ExtensionInstallationManager.cs component's failure to canonicalize and validate file paths before extraction (GitHub Commit). A malicious NUPKG archive (a ZIP-based format) can contain file entries with path traversal sequences such as ../../target-file, causing the extraction routine to write files to arbitrary locations on the filesystem. The fix introduced Path.GetFullPath() canonicalization and a prefix check ensuring the resolved target path starts with the intended extensions directory path before extraction proceeds; if the check fails, the partially extracted directory is deleted and a critical log entry is written (GitHub Commit, GitHub PR). This class of vulnerability is commonly known as "Zip Slip" and is well-documented across many ecosystems (GitHub Advisory).

Successful exploitation allows an attacker to overwrite arbitrary files on the victim's system with the privileges of the DevToys process, which typically runs as the logged-in user. This can lead to code execution (e.g., by overwriting application binaries or startup scripts), configuration tampering, or corruption of application and system files (GitHub Advisory). Specific impact scenarios include dropping executable payloads, modifying configuration files, and potentially escalating to broader system compromise depending on the user's privilege level and environment (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.037%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though CISA referenced it in a weekly vulnerability bulletin (CISA Bulletin). Exploitation requires a user to install a malicious extension package, meaning some degree of social engineering is needed to deliver the crafted NUPKG to a victim.

1. Craft a malicious NUPKG archive: Create a ZIP-based NUPKG file containing file entries with path traversal sequences (e.g., ../../AppData/Roaming/target.exe or ../../startup-script.bat) pointing to sensitive locations outside the extensions directory.
2. Embed a payload: Place a malicious executable, DLL, or script as the content of the traversal-targeted file entry within the archive to achieve code execution upon the next application launch or user action.
3. Distribute the malicious package: Host the crafted NUPKG on a website, repository, or share it via social engineering (e.g., posing as a legitimate DevToys extension on forums or third-party sites).
4. Induce the victim to install the extension: Convince a user running DevToys v2.0.0.0–2.0.8.x to install the malicious extension package through the DevToys extension manager UI.
5. Achieve arbitrary file write: During extraction, DevToys processes the archive entries without path validation, writing the attacker-controlled payload to the traversal-specified location on the filesystem with the privileges of the DevToys process.
6. Trigger code execution: Depending on the overwritten file (e.g., a startup script, scheduled task, or application binary), the payload executes automatically or upon the next relevant system/application event (GitHub Advisory, GitHub Commit).

• File System: Unexpected files written outside the DevToys extensions directory (e.g., in %APPDATA%, %PROGRAMFILES%, user home directories, or system directories) with timestamps correlating to a DevToys extension installation event; new or modified executables, DLLs, or scripts in startup folders or application directories.
• Logs: DevToys application logs containing the critical message "Security violation: Extension '<id>' contains path traversal sequence" (present only in patched versions); absence of this log in older versions despite suspicious extension installs.
• Process: Unexpected child processes spawned by the DevToys process following an extension installation; unusual file write operations by the DevToys process to directories outside its normal working paths.
• Network: Downloads of NUPKG files from untrusted or unknown sources in browser or application network logs around the time of a DevToys extension installation (GitHub Commit).

Upgrade DevToys to version 2.0.9.0 or later, which was released on January 8, 2026, and includes the path traversal fix (GitHub Advisory). If immediate upgrade is not possible, the following workarounds are available: avoid installing any untrusted or third-party extension packages; Windows users may roll back to DevToys v1.x as an interim measure (GitHub Advisory). Additionally, restrict extension installation to trusted sources only and monitor DevToys processes for suspicious file write operations outside expected directories (Feedly).

The vulnerability was reported by community member lihnucs and patched by contributors btiteux and veler on the same day it was disclosed (January 8, 2026), demonstrating a rapid response from the DevToys maintainers (GitHub Advisory). The Hacker Wire covered the vulnerability and shared it on Mastodon and Bluesky, generating some community awareness (Feedly). CISA included the CVE in its weekly vulnerability bulletin for the week of January 5, 2026 (CISA Bulletin).