Full Report
Cybersecurity researchers have disclosed details of a now-patched bug impacting Open VSX's pre-publish scanning pipeline to cause the tool to allow a malicious Microsoft Visual Studio Code (VS Code) extension to pass the vetting process and go live in the registry. "The pipeline had a single boolean return value that meant both 'no scanners are configured' and 'all scanners failed to run,'" Koi
Analysis Summary
# Vulnerability: "Open Sesame" Fail-Open Bug in Open VSX Pre-Publish Scanner
## CVE Details
- **CVE ID**: Not specified (Referred to by the codename **Open Sesame**)
- **CVSS Score**: Not provided (Estimated High severity due to security control bypass)
- **CWE**: CWE-252 (Unchecked Return Value) / CWE-391 (Unchecked Error Condition)
## Affected Systems
- **Products**: Eclipse Open VSX (Extension Registry for VS Code forks like Cursor and Windsurf)
- **Versions**: Versions prior to v0.32.0 (specifically those implementing the new pre-publish scanning pipeline)
- **Configurations**: Systems where the Java-based pre-publish scanner service is enabled to vet `.VSIX` extensions.
## Vulnerability Description
The flaw resides in the design of the Java-based pre-publish scanning pipeline. The pipeline utilized a single **boolean return value** that failed to distinguish between two distinct states:
1. "No scanners are configured" (a legitimate state where an extension is allowed through).
2. "The scanner failed to run" (an error state, e.g., due to database connection exhaustion).
Because these two states shared the same return value, the system "failed open." Exhausting the database connection pool caused the scanner job to fail to enqueue; the system interpreted this failure as a "no scanners" scenario and automatically marked malicious extensions as having passed the vetting process, making them immediately available for download.
## Exploitation
- **Status**: Disclosed and patched; PoC methodology described (flooding the publish endpoint).
- **Complexity**: Low (Requires only a free publisher account and a method to flood the endpoint).
- **Attack Vector**: Network (Remote)
## Impact
- **Confidentiality**: High (Allows distribution of malicious extensions that can steal data).
- **Integrity**: High (Allows malicious code to be injected into developer environments).
- **Availability**: Medium (The exploitation method involves exhausting resources like the database connection pool).
## Remediation
### Patches
- **Open VSX version 0.32.0**: This version addresses the bug by ensuring failure states are explicitly handled rather than defaulting to a "pass" condition.
- **Commit**: `64720cc8d7a71de580c242b8d4a19c5c9771c889`
### Workarounds
- No manual workarounds provided; users of self-hosted Open VSX instances should update to the latest version immediately.
## Detection
- **Indicators of Compromise**: Multiple extensions being published rapidly from a single publisher account followed by scanner failure logs.
- **Detection Methods**: Review Open VSX logs for "database connection pool exhausted" errors or scanner job enqueue failures occurring simultaneously with successful extension publications.
## References
- **Vendor Advisory**: hxxps[://]github[.]com/eclipse-openvsx/openvsx/releases/tag/v0.32[.]0
- **Researcher Report**: hxxps[://]www[.]koi[.]ai/blog/open-sesame-how-a-fail-open-bug-in-open-vsxs-new-scanner-let-malware-walk-right-in
- **Technical Coverage**: hxxps[://]thehackernews[.]com/2026/03/open-vsx-bug-let-malicious-vs-code[.]html