Vulnerabilities & Exploits · Supply Chain

Open VSX bug lets malicious VS Code extensions bypass pre-publish checks

A logic error in Open VSX's scan pipeline misclassified scanner failures as 'no scanners configured', allowing malicious Visual Studio Code extensions to pass pre-publish security checks and go live. The issue affected Open VSX-powered marketplaces and was fixed in v0.32.0.

1 source · Mar 27

Timeline

• Mar 27 Reported by The Hacker News

Sources

• Mar 27 The Hacker News

  Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks

  Open VSX bug misread scanner failures as clean results, letting malicious VS Code extensions go live before patch in v0.32.0.

  original

Part of the PlainSec briefing for 2026-03-27

Every edition of this story: Open VSX bug lets malicious VS Code extensions bypass pre-publish checks

More from today

• Langflow code-injection flaw actively exploited after disclosure
• Unauthenticated RCE in Secure Firewall Management Center
• Immediate attacks target Oracle WebLogic RCE flaw