fixes #54399

src/vs/workbench/parts/update/electron-browser/releaseNotesEditor.ts

@@ -158,6 +158,13 @@ export class ReleaseNotesManager {
 		if (!this._releaseNotesCache[version]) {
 			this._releaseNotesCache[version] = this._requestService.request({ url })
 				.then(asText)
+				.then(text => {
+					if (!/^#\s/.test(text)) { // release notes always starts with `#` followed by whitespace
+						return TPromise.wrapError<string>(new Error('Invalid release notes'));
+					}
+
+					return TPromise.wrap(text);
+				})
 				.then(text => patchKeybindings(text));
 		}