Open VSX Scanner Vulnerability Lets Malicious Extensions Go Live

Open VSX fixed a critical ‘Open Sesame’ vulnerability in its pre-publish scanning pipeline that could be triggered by exhausting backend resources, causing scanner job failures to be misinterpreted as ‘no scanners configured’ and allowing malicious extensions to be published with a false “PASSED” status; the issue was responsibly disclosed on February 8, 2026 and patched within three days on February 11.