Open VSX’s New Scanner Vulnerability Allows Malicious Extension Goes Live

A "fail-open" vulnerability named "Open Sesame" in the Open VSX extension marketplace allowed malicious .vsix packages to bypass the platform's pre-publish security scanners because a boolean return value could not distinguish between ‘no scanners configured’ and ‘scanner job failures’; an attacker could trigger the condition by flooding the publish endpoint to exhaust database connections. The flaw affected both the primary scanning submission logic and the recovery service, required no privileged access, was reported on Feb 8, 2026, and was fixed by the Open VSX team on Feb 11, 2026; users who installed extensions during the vulnerable window are advised to review them.