CVE-2026-22685 is a high severity path traversal flaw (CVSS 8.8) in the extension installer of DevToys, the desktop developer tool. It affects versions 2.0.0.0 to before 2.0.9.0. A crafted extension package can write files outside the extensions folder. The fix is DevToys 2.0.9.0.
What's affected
DevToys from 2.0.0.0 to before 2.0.9.0. The fixed version is 2.0.9.0. The advisory says it was released on 8 January 2026.
The flaw is in how DevToys processes extension packages, which are NUPKG archives.
How to check if you're exposed
Open DevToys and check the version on its settings or about screen. If it is in the 2.0.0.0 to 2.0.8.0 range, update.
Then list the extensions you have installed and note where each came from. The attack needs a user to install a malicious extension package, so the vector marks user interaction as required.
What to do now
- Update DevToys to 2.0.9.0 or later.
- Do not install extension packages from sources you do not trust.
- Review installed extensions and remove any you do not recognise.
- The advisory also lists rolling back to DevToys 1.x on Windows as an option, if you cannot update.
- Add DevToys to the list of developer tools you track for updates.
Why it matters
The weakness is CWE-22, path traversal. The record says DevToys does not sufficiently validate file paths inside an extension archive, so entries with parent directory markers can cause extraction outside the intended folder. This is the Zip Slip pattern, and the advisory names it.
The result is arbitrary file overwrite with the rights of the DevToys process. Depending on the machine, that can mean code execution, changed configuration or damaged files. The score is 8.8 because the vector shows high impact on all three axes with one user action required.
Developer machines hold source code, tokens and signing keys, so a tool that runs there deserves the same patching attention as a server component. The record does not say it is exploited in the wild, and it is not on the CISA KEV list.
Quick check
Do I have to install something for this to matter?
Yes. The vector marks user interaction as required, because a malicious extension package has to be installed.
Where do I get the fixed version?
The advisory says 2.0.9.0 is the patched version. Get it from the DevToys project.
Sources
Last reviewed: 19 October 2026.
