Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks

A critical vulnerability in Open VSX's pre-publish scanning pipeline has been discovered that allowed malicious VS Code extensions to bypass security checks and get published to the registry. The flaw, dubbed "Open Sesame" by security researchers at Koi Security, highlights how a single boolean return value can undermine an entire security infrastructure.

The Vulnerability: When Security Checks Fail Silently

The issue stems from how Open VSX's Java-based scanning service reports results. According to Koi Security researcher Oran Simhony, the pipeline used a single boolean return value that meant both "no scanners are configured" and "all scanners failed to run." This ambiguity created a dangerous scenario where the system couldn't distinguish between legitimate cases where no scanning was needed and actual failures in the scanning process.

When scanners failed under load, Open VSX treated it as "nothing to scan for" and allowed extensions to pass through without any security review. This meant that malicious extensions could be published to the registry without undergoing the intended vetting process.

How Attackers Could Exploit the Flaw

An attacker could exploit this vulnerability by flooding the publish endpoint with multiple malicious .VSIX extensions. This would cause concurrent load that exhausts the database connection pool, leading to scan job failures that the system misinterprets as "no scanning needed."

What makes this particularly concerning is that the attack doesn't require any special privileges. A malicious actor with a free publisher account could reliably trigger this vulnerability to undermine the scanning process and get their extension published.

The Broader Impact

Open VSX serves as the extension marketplace not just for VS Code, but also for Cursor, Windsurf, and other VS Code forks. This means the vulnerability potentially affected millions of developers using these popular development tools.

The flaw also impacted a recovery service designed to retry failed scans, which suffered from the same problem. This allowed extensions to skip the entire scanning process under certain conditions, creating multiple attack vectors for malicious actors.

The Fix and Lessons Learned

The vulnerability was addressed in Open VSX version 0.32.0 following responsible disclosure on February 8, 2026. However, the incident serves as a crucial reminder about secure software design patterns.

Koi Security emphasized that "pre-publish scanning is an important layer, but it's one layer." The researchers noted that the pipeline's design was fundamentally sound, but a single boolean that couldn't distinguish between "nothing to do" and "something went wrong" turned the entire infrastructure into a gate that opened under pressure.

Best Practices for Security Pipeline Design

This incident highlights a common anti-pattern in security systems: fail-open error handling that hides behind code paths designed for legitimate "nothing to do" cases. For developers building similar security pipelines, the key takeaway is to make failure states explicit and never let "no work needed" and "work failed" share a return value.

The Open VSX vulnerability demonstrates how even well-intentioned security measures can be undermined by subtle design flaws. As supply chain attacks continue to evolve, ensuring that security checks themselves are robust and fail-safe becomes increasingly critical for protecting the software development ecosystem.