Bypass of Open VSX Pre-Publish Scanning via Boolean Return Value Flaw
Summary
Hide ▲
Show ▼
A design flaw in Open VSX’s pre-publish scanning pipeline enabled malicious Visual Studio Code (VS Code) extensions to bypass security vetting and become publicly available in the registry. The issue stemmed from a single boolean return value that conflated two distinct states: absence of configured scanners and scanner job failures. Under load, scanner failures (e.g., due to exhausted database connection pools) were misinterpreted as "no scanners configured," causing the system to mark extensions as passed and activate them immediately. This affected both the initial publish flow and a recovery service designed to retry failed scans. An attacker with a standard publisher account could exploit the flaw by flooding the publish endpoint to exhaust the database connection pool, preventing scan jobs from enqueuing and allowing malicious extensions to evade detection. The flaw was patched in Open VSX version 0.32.0 on March 3, 2026, following disclosure on February 8, 2026.
Timeline
-
27.03.2026 15:57 1 articles · 2h ago
Boolean Return Value Flaw in Open VSX Pre-Publish Scanning Allows Malicious Extension Bypass
A design flaw in Open VSX’s pre-publish scanning pipeline caused scanner job failures to be misinterpreted as "no scanners configured," allowing malicious VS Code extensions to bypass security vetting and be published. The issue affected both the initial publish flow and a recovery service, enabling attackers with standard accounts to exploit load-induced database exhaustion to evade detection. The flaw was patched in Open VSX version 0.32.0 on March 3, 2026.
Show sources
- Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks — thehackernews.com — 27.03.2026 15:57
Information Snippets
-
The pre-publish scanning pipeline in Open VSX returned a single boolean value to indicate both "no scanners configured" and "all scanners failed to run," preventing differentiation between these states.
First reported: 27.03.2026 15:571 source, 1 articleShow sources
- Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks — thehackernews.com — 27.03.2026 15:57
-
Under load, scanner job failures caused by exhausted database connection pools were misinterpreted as "no scanners configured," allowing malicious extensions to bypass vetting and be published.
First reported: 27.03.2026 15:571 source, 1 articleShow sources
- Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks — thehackernews.com — 27.03.2026 15:57
-
A recovery service responsible for retrying failed scans shared the same flaw, enabling extensions to skip scanning entirely under certain failure conditions.
First reported: 27.03.2026 15:571 source, 1 articleShow sources
- Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks — thehackernews.com — 27.03.2026 15:57
-
An attacker with a standard publisher account could trigger the vulnerability by flooding the publish endpoint to exhaust the database connection pool, preventing scan jobs from being enqueued.
First reported: 27.03.2026 15:571 source, 1 articleShow sources
- Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks — thehackernews.com — 27.03.2026 15:57
-
The issue was addressed in Open VSX version 0.32.0, released on March 3, 2026, following responsible disclosure on February 8, 2026.
First reported: 27.03.2026 15:571 source, 1 articleShow sources
- Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks — thehackernews.com — 27.03.2026 15:57