CVE-2025-65717

Published Feb 16, 2026

Last updated 20 days ago

Visual Studio Code

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-65717 is a security vulnerability identified in the Live Server extension for Visual Studio Code, affecting version 5.7.9 and potentially all versions. This flaw allows attackers to exfiltrate local files from a developer's machine. The vulnerability is exploited when a user, with the Live Server extension actively running, is enticed to visit a malicious website. Once the malicious website is accessed, embedded JavaScript within the page can crawl and extract files from the local development HTTP server that the Live Server extension operates, typically on `localhost:5500`. These stolen files can then be transmitted to a domain under the attacker's control. This issue was reported by OX Security researchers in August 2025, but as of recent reports, it remains unpatched.

Description: An issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML page.
Source: cve@mitre.org
NVD status: Modified
Products: live_server

Risk scores

CVSS 3.1

Type: Secondary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:ritwickdey:live_server:*:*:*:*:*:visual_studio_code:*:*",
            "matchCriteriaId": "55888E99-6D1B-42D7-BEC4-AC57D15A4EA3",
            "versionStartIncluding": "5.7.9",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.