Back Cybersecuritynews

Open VSX’s New Scanner Vulnerability Allows Malicious Extension Goes Live

Cybersecuritynews •Tushar Subhra Dutta • March 30, 2026

A serious security flaw was recently found in Open VSX, the extension marketplace used by popular code editors like Cursor and Windsurf, as well as the broader VS Code fork ecosystem. The vulnerability was found inside the platform’s newly introduced pre-publish scanning pipeline, a security layer built to check every extension before it becomes available […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in Open VSX Allows Malicious Extensions to Bypass Security Open VSX, the extension marketplace for VS Code forks like Cursor and Windsurf, has addressed a critical vulnerability known as 'Open Sesame' in its pre-publish scanning pipeline. This flaw allowed malicious extensions to bypass security checks and be published undetected. The vulnerability resulted from a fail-open condition in the scanning workflow, posing a significant risk to users of these platforms. The issue affects all extensions published through Open VSX, potentially compromising the security of numerous code editors relying on this marketplace. The vulnerability was fixed shortly before the articles were published, but the scope of impact remains concerning as malicious actors could exploit it. Users are urged to remain vigilant and ensure their extensions are from trusted sources. The exact number of affected extensions is not specified, but the risk is substantial given the popularity of the marketplace. Current status indicates that the vulnerability has been patched, but awareness and caution are still necessary. 2 sources 68

Extracted Entities

Open VSX’s New Scanner Vulnerability Allows Malicious Extension Goes Live

The full story

Extracted Entities

Companies (1)

Platforms (1)

Vulnerabilities (1)