- Description
- An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace.
- Source
- cve@mitre.org
- NVD status
- Analyzed
- Products
- coderunner
CVSS 3.1
- Type
- Secondary
- Base score
- 7.8
- Impact score
- 5.9
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity
- HIGH
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- CWE-94
- Hype score
- Not currently trending
Most teams monitor code. Few monitor editor settings. CVE-2025-65715: VS Code Code Runner shows settings.json/executorMap can enable RCE + persistence. Takeaway: lock settings, restrict workspace overrides, treat extensions as privileged. Watching settings.json like code? #AI htt
@Wisr_AI
16 Mar 2026
119 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
⚠️ Vulnerabilidades en productos Microsoft ❗ CVE-2025-65716 ❗ CVE-2025-65715 ➡️ Más info: https://t.co/l2ynmS1gXY https://t.co/Lu1r6yBSRd
@CERTpy
26 Feb 2026
131 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
VS Codeの主要な拡張機能4件で危険性のある脆弱性-最大1.2億に影響(CVE-2025-65717,CVE-2025-65715,CVE-2025-65716) https://t.co/aonBEILRnS #セキュリティ対策Lab #セキュリティ #Security #CybersecurityNews
@securityLab_jp
24 Feb 2026
69 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-65715 (CVSS:7.8, HIGH) is Awaiting Analysis. An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to..https://t.co/2N4hc4r4rH #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
@cracbot
21 Feb 2026
38 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 128M VS Code Extension Installs Exposed: Critical CVEs Enable RCE & File Exfiltration From Developer Machines OX Security disclosed three critical flaws (CVE-2025-65715/65716/65717) across widely used VS Code extensions (Live Server, Code Runner, Markdown Preview Enhance
@ThreatSynop
20 Feb 2026
66 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Critical VS Code Extension Flaws Put 128M+ Installs at Risk of File Theft and Remote Code Execution High-to-critical vulnerabilities in popular VS Code extensions—Live Server (CVE-2025-65715), Code Runner (CVE-2025-65716), Markdown Preview Enhanced (CVE-2025-65717), and
@ThreatSynop
19 Feb 2026
105 Impressions
0 Retweets
1 Like
1 Bookmark
0 Replies
0 Quotes
🚨 125M+ VS Code Installs at Risk: 4 Popular Extensions Enable File Exfiltration & Remote Code Execution OX Security disclosed high/critical flaws across Live Server (CVE-2025-65717), Code Runner (CVE-2025-65715), and Markdown Preview Enhanced (CVE-2025-65716), plus an issu
@ThreatSynop
18 Feb 2026
160 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
VSCodeの人気拡張機能複数に脆弱性。Ox Security社報告。Code Runner (CVE-2025-65715)、Markdown Preview Enhanced (CVE-2025-65716)…Markdown Preview Enhanced (CVE-2025-65717)、Microsoft Live Preview（CVE未採番）。 https://t.co/pdjft1uOcU
@__kokumoto
18 Feb 2026
1368 Impressions
3 Retweets
7 Likes
4 Bookmarks
2 Replies
0 Quotes
I disclosed these vulnerabilities and got issued 3 out of 4 CVEs CVE-2025-65715: Code Runner (37M+) CVE-2025-65716: Markdown Preview Enhanced (8.5M+) CVE-2025-65717: Live Server (72M+) No CVE (but fixed): Live Preview by Microsoft (11M+) https://t.co/herjrTX2Vx
@MosheTov
17 Feb 2026
21 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
We Found 4 Vulnerabilities in IDE Extensions With Over 120M(!) Downloads 3 of them were issued a CVE & the only one without a CVE is the only one that was fixed.. WHAT? 😶 CVE-2025-65715: Code Runner CVE-2025-65716: Markdown CVE-2025-65717: Live Server https://t.co/herj
@MosheTov
17 Feb 2026
48 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-65715 Code Execution Vulnerability in Visual Studio Code Extensions Code Runner v0.12.2 https://t.co/NNBzetpA92
@VulmonFeeds
16 Feb 2026
44 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:formulahendry:coderunner:*:*:*:*:*:visual_studio_code:*:*",
"matchCriteriaId": "D7C6C3DC-1FD5-41EC-A293-455C2950F530",
"versionStartIncluding": "0.12.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]