Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks

This article covers a now-patched vulnerability in Open VSX's pre-publish extension scanning pipeline that allowed malicious VS Code extensions to bypass security checks.

• •The bug, codenamed "Open Sesame", stemmed from a single boolean return value that conflated "no scanners configured" with "all scanners failed to run", causing the system to fail-open.
• •An attacker could flood the publish endpoint with multiple .VSIX files to exhaust the database connection pool, causing scan jobs to fail to enqueue and extensions to be auto-approved.
• •No special privileges were required — a free publisher account was sufficient to exploit the vulnerability.
• •A recovery service meant to retry failed scans had the same flaw, removing any fallback protection.
• •