Deep dive into Visual Studio Code extension security vulnerabilities

snyk.iosite

VS Code extensions have vulnerabilities (command injection, path traversal, zip slip) that can compromise developer machines.

from

CI/CD Attacks

added

2026-10-10

likes

0

similar

1. ▲

   Can You Trust Your VSCode Extensions? aquasec.com

   Impersonate popular VSCode extensions and trick unknowing developers into downloading them.

   site topic programming link ↗
   
2. ▲

   Deploy VS Code Extension to Visual Studio Marketplace or the Open VSX Registry github.com

   tool link ↗
   tool
3. ▲

   Visual Studio Code github.com

   Cross-platform IDE.

   tool topic programming link ↗
   tool
4. ▲

   Deploy VS Code extensions with vsce github.com

   tool link ↗
   
5. ▲

   The Secure Developer mydevsecops.io

   Snyk - Discussion about security tools and best practices for software developers.

   site topic programming link ↗
   site
6. ▲

   VS Code Extension marketplace.visualstudio.com

   An alternative to the built-in Code Editor.

   site topic programming link ↗
   

CI/CD Attacks › Techniques > Initial Code Execution: “VS Code extensions have vulnerabilities (command injection, path traversal, zip slip) that can compromise developer machines.”