PowerShell / PowerShell/vscode-powershell
[Ctrl]+[F1] on a keyword in the editor window leads to a Security Warning dialog in the terminal window
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1.9k
- Forks
- 547
- PR merge metrics
- No merged PRs in 30d
Description
Prerequisites
- I have written a descriptive issue title.
- I have searched all open and closed issues to ensure it has not already been reported.
- I have read the troubleshooting guide.
- I am sure this issue is with the extension itself and does not reproduce in a standalone PowerShell instance.
- I have verified that I am using the latest version of Visual Studio Code and the PowerShell extension.
- If this is a security issue, I have read the security issue reporting guidance.
Summary
When pressing [Ctrl]+[F1] on a keyword in the editor window ...
Expected:
The default browser opens with contextual help for the keyword
Actual:
The terminal window presents a Security Warning dialog that has to be answered positively before the browser opens:
Security Warning: Script Execution Risk
Invoke-WebRequest parses the content of the web page. Script code in the web page might be run when the page is parsed.
RECOMMENDED ACTION:
Use the -UseBasicParsing switch to avoid script code execution.
Do you want to continue?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"):
This seems to stem from a PowerShell security update from December 2025 that adds the warning before running Invoke-WebRequest without -UseBasicParsing
PowerShell Version
Name Value
---- -----
PSVersion 5.1.26100.7462
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.26100.7462
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
Name : Visual Studio Code Host
Version : 2025.4.0
InstanceId : 81e2ecd0-03b3-490b-8967-028b626f7b72
UI : System.Management.Automation.Internal.Host.InternalHostUserInterface
CurrentCulture : de-AT
CurrentUICulture : de-DE
PrivateData : Microsoft.PowerShell.ConsoleHost+ConsoleColorProxy
DebuggerEnabled : True
IsRunspacePushed : False
Runspace : System.Management.Automation.Runspaces.LocalRunspace
Visual Studio Code Version
1.111.0
ce099c1ed25d9eb3076c11e4a280f3eb52b4fbeb
x64
Extension Version
ms-vscode.powershell@2025.4.0
Steps to Reproduce
- Press [Ctrl]+[F1] on a keyword in the editor window
- Terminal window presents an unexpected Security Warning
Visuals
No response
Logs
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start from the Ctrl+F1 contextual-help entry point and trace the request that invokes Invoke-WebRequest. Reproduce the warning on Windows PowerShell 5.1, then verify that contextual help opens in the default browser without presenting a Security Warning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell, typescript, vscode
- Domain
- developer-experience
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100