Vulnerabilities · 217 days ago

Open VSX bug lets malicious VS Code extensions bypass pre-publish checks

That logic error allowed malicious Visual Studio Code extensions to be activated and downloaded without review.

Timeline

• Mar 27 Reported by The Hacker News

Sources

1 source covering this story

• The Hacker News Mar 27

  Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks

  Open VSX bug misread scanner failures as clean results, letting malicious VS Code extensions go live before patch in v0.32.0.

Part of the PlainSec briefing for 2026-03-28

Editions

• Briefing for 2026-03-28
• Briefing for 2026-03-27

Related stories

• CISA Adds BIG‑IP APM RCE to Known Exploited Vulnerabilities
• Langflow RCE added to CISA Known Exploited catalog
• Citrix NetScaler flaws risk memory disclosure and session mix‑up