diff --git a/.changes/fix-fs-open-custom-flags.md b/.changes/fix-fs-open-custom-flags.md
new file mode 100644
index 000000000..d633ce1b7
--- /dev/null
+++ b/.changes/fix-fs-open-custom-flags.md
@@ -0,0 +1,6 @@
+---
+fs: patch
+fs-js: patch
+---
+
+**Security:** the `open` command no longer accepts a `customFlags` option from the webview. It was not part of the JavaScript types and let the webview pass arbitrary `open(2)` flags (e.g. `O_TRUNC`) to files it may only read. `OpenOptionsExt::custom_flags` still works from Rust.
diff --git a/plugins/fs/src/lib.rs b/plugins/fs/src/lib.rs
index ed7854c21..508a4ea45 100644
--- a/plugins/fs/src/lib.rs
+++ b/plugins/fs/src/lib.rs
@@ -83,7 +83,9 @@ pub struct OpenOptions {
     #[serde(default)]
     #[allow(unused)]
     mode: Option<u32>,
-    #[serde(default)]
+    // Never deserialized: the webview must not be able to pass arbitrary `open(2)` flags
+    // (e.g. `O_TRUNC`), it can only be set from Rust with `OpenOptionsExt::custom_flags`.
+    #[serde(skip)]
     #[allow(unused)]
     custom_flags: Option<i32>,
 }
@@ -663,4 +665,12 @@ mod tests {
             "w"
         );
     }
+
+    #[test]
+    fn open_options_ignore_custom_flags_from_ipc() {
+        let options: OpenOptions =
+            serde_json::from_str(r#"{ "read": true, "customFlags": 512 }"#).unwrap();
+        assert!(options.read);
+        assert_eq!(options.custom_flags, None);
+    }
 }