Back Gbhackers

Open VSX Scanner Vulnerability Lets Malicious Extensions Go Live

Gbhackers •Mayura Kathir • March 28, 2026

Open VSX, the extension marketplace used by VS Code forks such as Cursor and Windsurf, recently fixed a critical vulnerability in its newly introduced pre-publish scanning pipeline that could allow malicious extensions to bypass security checks and go live undetected. The issue, dubbed “Open Sesame,” stemmed from a fail-open condition in the scanning workflow. While […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in Open VSX Allows Malicious Extensions to Bypass Security Open VSX, the extension marketplace for VS Code forks like Cursor and Windsurf, has addressed a critical vulnerability known as 'Open Sesame' in its pre-publish scanning pipeline. This flaw allowed malicious extensions to bypass security checks and be published undetected. The vulnerability resulted from a fail-open condition in the scanning workflow, posing a significant risk to users of these platforms. The issue affects all extensions published through Open VSX, potentially compromising the security of numerous code editors relying on this marketplace. The vulnerability was fixed shortly before the articles were published, but the scope of impact remains concerning as malicious actors could exploit it. Users are urged to remain vigilant and ensure their extensions are from trusted sources. The exact number of affected extensions is not specified, but the risk is substantial given the popularity of the marketplace. Current status indicates that the vulnerability has been patched, but awareness and caution are still necessary. 2 sources 68

Open VSX Scanner Vulnerability Lets Malicious Extensions Go Live

The full story

Extracted Entities

Companies (1)

Vulnerabilities (1)