Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourself
The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
You are now subscribed
Your newsletter sign-up was successful
Three newly discovered flaws in Visual Studio Code (VS Code) extensions enable local file exfiltration and remote code execution, researchers have warned, and they’ve been downloaded more than 128 million times.
The affected Integrated Development Environment (IDE) extensions are Code Runner (CVE-2025-65715), Markdown Preview Enhanced (CVE-2025-65716), and Markdown Preview Enhanced (CVE-2025-65717).
According to OX Security, the trio of flaws could enable lateral movement potential within connected networks. They also allow data exfiltration and system takeover when executed on a development machine running a localhost server, presenting a high risk of sensitive data exposure and potential machine takeover.
"IDEs are the weakest link in an organization’s supply chain security, and extensions are often a blind spot for security teams," OX Security noted in a blog post.
"Developers store their most sensitive information – business logic, API keys, database configurations, environment variables, and sometimes even customer data – on their local file systems, all accessible through the IDE."
Under the hood of the VS Code flaws
CVE-2025-65717 is the most serious vulnerability, with a CVSS score of 9.1. This flaw primarily affects Visual Studio Code Extensions Live Server v5.7.9, allowing attackers to exfiltrate files when a user interacts with a crafted HTML page.
Researchers warned this particular extension has been downloaded more than 72 million times.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
CVE-2025-65715, meanwhile, carries a CVSS score of 7.8. This flaw relates to an issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2.
Downloaded 37 million times, this allows attackers to execute arbitrary code when opening a crafted workspace.
Elsewhere, CVE-2025-65716 affects Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18, which boasts more than 8.5 million downloads. This flaw carries a CVSS score of 8.8 and allows attackers to execute arbitrary code via uploading a crafted .Md file.
The team also identified a flaw in Microsoft Live Preview, downloaded more than 11 million times, allowing One-Click XSS to full IDE files exfiltration; this was fixed in v0.4.16, with no CVE issued.
How developers can protect themselves
OX Security urged developers to avoid opening untrusted HTML while localhost servers are running or running servers on localhost.
Researchers said they should never paste or run snippets in the global settings.json from emails, chats, or unverified sources, and are advised to only install trusted extensions and monitor or back up settings.json to detect unexpected changes.
"Keeping vulnerable extensions installed on a machine is an immediate threat to an organization’s security posture: it may take only one click, or a downloaded repository, to compromise everything," Ox Security warned.
"Our research demonstrates that a hacker needs only one malicious extension, or a single vulnerability within one extension, to perform lateral movement and compromise entire organizations."
The flaws have flown under the radar
OX Security said it disclosed all three vulnerabilities in July and August 2025, but that none of the maintainers responded.
"The lack of response from extension maintainers, despite months of responsible disclosure attempts through multiple channels, underscores a systemic problem: there is no accountability framework for extension security, and no incentive structure to ensure timely remediation of critical vulnerabilities," the firm.
The company is now calling for mandatory security review processes before extensions are published to marketplaces in a similar vein to app store vetting.
In addition, OX Security also called for enforceable response requirements for maintainers of popular extensions, including mandatory CVE issuance and patch timelines.
FOLLOW US ON SOCIAL MEDIA
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
Google just added a new automated code review feature to Gemini CLINews A new feature in the Gemini CLI extension looks to improve code quality through verification
-
Ransomware protection for all: How consumption-based subscription models can lower the entry point for cyber resilienceIndustry Insights Consumption-based immutable backup makes enterprise-grade ransomware resilience affordable to all
-
CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaughtNews While the CVE figures might be daunting, they won't all be relevant to your organization
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Experts welcome EU-led alternative to MITRE's vulnerability tracking schemeNews The EU-led framework will reduce reliance on US-based MITRE vulnerability reporting database
-
Veeam patches Backup & Replication vulnerabilities, urges users to updateNews The vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds – but not previous versions.
-
Two Fortinet vulnerabilities are being exploited in the wild – patch nowNews Arctic Wolf and Rapid7 said security teams should act immediately to mitigate the Fortinet vulnerabilities
-
Everything you need to know about Google and Apple’s emergency zero-day patchesNews A serious zero-day bug was spotted in Chrome systems that impacts Apple users too, forcing both companies to issue emergency patches
-
Security experts claim the CVE Program isn’t up to scratch anymore — inaccurate scores and lengthy delays mean the system needs updatedNews CVE data is vital in combating emerging threats, yet inaccurate ratings and lengthy wait times are placing enterprises at risk
-
IBM AIX users urged to patch immediately as researchers sound alarm on critical flawsNews Network administrators should patch the four IBM AIX flaws as soon as possible
