GCVE-110-OSM-2026-13080

Advisory PublishedCVSS 5.4/10

Vulnetix · Advisory published October 2, 2026

Theme Charcoal Mint Co. is a cluster-linked Open VSX extension that had accumulated approximately 10,000 downloads at time of investigation. It was promoted in the same December 2025 DEV Community article as other cluster extensions. No active payload was observed in the analyzed version, but it retains executable functionality unnecessary for a conventional color theme. No active payload observed in analyzed version. ~10,000 Open VSX downloads at time of investigation. Promoted in the same December 2025 DEV Community article as other GlassWorm-linked cluster extensions; retains unnecessary executable functionality for a color theme.

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

5.4/10

Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions	Platforms
unknown	charcoal-mint-studio.theme-charcoal-mint	all (affected)	—

References

Malicious vscode package: charcoal-mint-studio.theme-charcoal-mint

advisory

vendor

Browse GCVE Records

3,164 records in the GCVE database · Updated October 4, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON