--- title: Security Vulnerabilities in IDE Extension Verification... description: Security researchers discovered critical vulnerabilities in IDE extension verification systems across Visual Studio Code, IntelliJ IDEA, and other popular... canonical: https://daily.dev/posts/security-vulnerabilities-in-ide-extension-verification-process-pose-risks-to-developers-q3er33it1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security Vulnerabilities in IDE Extension Verification Process Pose Risks to Developers | daily.dev og:description: Security researchers discovered critical vulnerabilities in IDE extension verification systems across Visual Studio Code, IntelliJ IDEA, and other popular... og:url: https://daily.dev/posts/security-vulnerabilities-in-ide-extension-verification-process-pose-risks-to-developers-q3er33it1 og:image: https://api.daily.dev/og/posts/q3Er33it1.png og:image:alt: Security Vulnerabilities in IDE Extension Verification Process Pose Risks to Developers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security Vulnerabilities in IDE Extension Verification Process Pose Risks to Developers **[Collections](https://daily.dev/sources/collections)** · 2 min read · 2 upvotes · 0 comments ## Summary Security researchers discovered critical vulnerabilities in IDE extension verification systems across Visual Studio Code, IntelliJ IDEA, and other popular development environments. Attackers can bypass verification checks by copying tokens from trusted extensions and injecting malicious code while maintaining verified status. The exploits allow spoofing of publisher credentials and execution of harmful commands on developer workstations. Despite reports to vendors like Microsoft, the issues are considered "by design" and remain unpatched, creating significant supply chain security risks for developers who often have privileged system access. ## Content # Security Concerns: Vulnerabilities in IDE Extension Verification Processes Security researchers have uncovered critical vulnerabilities in the extension verification processes of popular Integrated Development Environments (IDEs) such as Visual Studio Code, Visual Studio, IntelliJ IDEA, and Cursor. These vulnerabilities give attackers the ability to manipulate verification badges and make malicious extensions appear trustworthy. The exploit is centered around bypassing verification checks that determine whether an extension is legitimate. Attackers can copy verification tokens from trusted extensions and inject malicious code, maintaining their verified status despite containing malicious components. The vulnerability has been reported to IDE vendors, including Microsoft, but is considered "by design," meaning it has not been addressed, leaving the exploits active. This is particularly concerning for sideloaded extensions, which bypass the security checks typically enforced by official marketplaces. The flaw further allows attackers to spoof legitimate publisher credentials through manipulation of HTTP requests connecting to marketplace domains. This enables malicious extensions to display a verified status while potentially executing harmful system commands on developer workstations without detection. These vulnerabilities pose significant risks to the software supply chain, as developers, who may unknowingly download compromised extensions, often hold privileged access on their workstations. Despite the findings, the issue has not been prioritized as a major security concern by IDE vendors, with some suggesting that users adhere to installing extensions from official sources only. Overall, the revelation underscores the need for heightened security measures and scrutiny when dealing with IDE extensions, urging both developers and vendors to reassess trust and verification processes within their systems. ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vulnerability](https://daily.dev/tags/vulnerability), [#vscode](https://daily.dev/tags/vscode), [#supply-chain](https://daily.dev/tags/supply-chain) [View this post on daily.dev](https://daily.dev/posts/security-vulnerabilities-in-ide-extension-verification-process-pose-risks-to-developers-q3er33it1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security Vulnerabilities in IDE Extension Verification Process Pose Risks to Developers","url":"https://daily.dev/posts/security-vulnerabilities-in-ide-extension-verification-process-pose-risks-to-developers-q3er33it1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-vulnerabilities-in-ide-extension-verification-process-pose-risks-to-developers-q3er33it1"},"datePublished":"2025-07-03T13:04:27.992Z","dateModified":"2025-07-04T13:14:49.742Z","description":"Security researchers discovered critical vulnerabilities in IDE extension verification systems across Visual Studio Code, IntelliJ IDEA, and other popular...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/80a624ee9fd9865049cbbf0dfab9a86e?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/80a624ee9fd9865049cbbf0dfab9a86e?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-vulnerabilities-in-ide-extension-verification-process-pose-risks-to-developers-q3er33it1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vulnerability,vscode,supply-chain","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Security Vulnerabilities in IDE Extension Verification Process Pose Risks to Developers"}]} ```