Vulnerabilities & Exploits · Supply Chain

Open VSX bug lets malicious VS Code extensions bypass pre-publish checks

That logic error allowed malicious Visual Studio Code extensions to be activated and downloaded without review.

1 source · Mar 27

Timeline

• Mar 27 Reported by The Hacker News

Sources

• Mar 27 The Hacker News

  Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks

  Open VSX bug misread scanner failures as clean results, letting malicious VS Code extensions go live before patch in v0.32.0.

  original

Part of the PlainSec briefing for 2026-03-28

Every edition of this story: Open VSX bug lets malicious VS Code extensions bypass pre-publish checks

More from today

• CISA Adds BIG‑IP APM RCE to Known Exploited Vulnerabilities
• Langflow RCE added to CISA Known Exploited catalog
• Citrix NetScaler flaws risk memory disclosure and session mix‑up