PowerShell / PowerShell/vscode-powershell

[Ctrl]+[F1] on a keyword in the editor window leads to a Security Warning dialog in the terminal window

Open
#5,427 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue-Bug Needs: Triage
Dominant language
TypeScript
Stars
1.9k
Forks
547
PR merge metrics
No merged PRs in 30d

Description

Prerequisites
  • I have written a descriptive issue title.
  • I have searched all open and closed issues to ensure it has not already been reported.
  • I have read the troubleshooting guide.
  • I am sure this issue is with the extension itself and does not reproduce in a standalone PowerShell instance.
  • I have verified that I am using the latest version of Visual Studio Code and the PowerShell extension.
  • If this is a security issue, I have read the security issue reporting guidance.
Summary

When pressing [Ctrl]+[F1] on a keyword in the editor window ...

Expected:
The default browser opens with contextual help for the keyword

Actual:
The terminal window presents a Security Warning dialog that has to be answered positively before the browser opens:

Security Warning: Script Execution Risk
Invoke-WebRequest parses the content of the web page. Script code in the web page might be run when the page is parsed.
      RECOMMENDED ACTION:
      Use the -UseBasicParsing switch to avoid script code execution.

      Do you want to continue?
      [Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"):

This seems to stem from a PowerShell security update from December 2025 that adds the warning before running Invoke-WebRequest without -UseBasicParsing

PowerShell Version
Name                           Value
----                           -----
PSVersion                      5.1.26100.7462
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.26100.7462
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Name             : Visual Studio Code Host
Version          : 2025.4.0
InstanceId       : 81e2ecd0-03b3-490b-8967-028b626f7b72
UI               : System.Management.Automation.Internal.Host.InternalHostUserInterface
CurrentCulture   : de-AT
CurrentUICulture : de-DE
PrivateData      : Microsoft.PowerShell.ConsoleHost+ConsoleColorProxy
DebuggerEnabled  : True
IsRunspacePushed : False
Runspace         : System.Management.Automation.Runspaces.LocalRunspace
Visual Studio Code Version
1.111.0
ce099c1ed25d9eb3076c11e4a280f3eb52b4fbeb
x64
Extension Version
ms-vscode.powershell@2025.4.0
Steps to Reproduce
  • Press [Ctrl]+[F1] on a keyword in the editor window
  • Terminal window presents an unexpected Security Warning
Visuals

No response

Logs

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start from the Ctrl+F1 contextual-help entry point and trace the request that invokes Invoke-WebRequest. Reproduce the warning on Windows PowerShell 5.1, then verify that contextual help opens in the default browser without presenting a Security Warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell, typescript, vscode
Domain
developer-experience
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.