Vulnerabilities · 172 days ago

Open VSX Bug Lets Malicious VS Code Extensions Bypass Pre-Publish Checks

That logic error allowed malicious Visual Studio Code extensions to be activated and downloaded without review.

Timeline

• Mar 27 Reported by The Hacker News

Sources

1 source covering this story

• The Hacker News Mar 27

  Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks

  Open VSX bug misread scanner failures as clean results, letting malicious VS Code extensions go live before patch in v0.32.0.

Part of the PlainSec briefing for 2026-03-28

Editions

• Briefing for 2026-03-28
• Briefing for 2026-03-27

Related stories

• CISA Adds BIG‑IP APM RCE to Known Exploited Vulnerabilities
• Langflow RCE Added to CISA Known Exploited Catalog
• Citrix NetScaler Flaws Risk Memory Disclosure and Session Mix‑up