Loading story…
A command injection vulnerability in the end-of-life Spring CLI VS Code extension allows arbitrary command execution on a developer’s machine, tracked as CVE-2026-22718. The issue affects Spring CLI VSCode Extension v0.9.0 and earlier and is described as a local attack scenario requiring user interaction (e.g., interacting with crafted content/projects) to trigger execution in the context of the logged-in user, potentially enabling access to sensitive files, credentials, source code, and system configuration changes.
The extension reached EOL on May 14, 2025, and the Spring team issued the CVE despite the retirement to improve security communication for users who may still have it installed. Both reports state there is no patch due to unsupported status; the primary mitigation is to uninstall/remove the extension and transition to supported Spring development tooling. Reported severity is medium (one source cites CVSS 6.3, another CVSS 6.6), and the vulnerability was responsibly reported by researcher Yue Liu.
Map this exposure pattern across your cloud, code, and identities.
3 events from the most recent confirmed update back to the earliest known activity.
Spring publicly disclosed CVE-2026-22718, warning that the end-of-life Spring CLI VS Code extension contains a command injection issue and that no fix will be released because the product is unsupported. Users were advised to uninstall the extension and move to supported alternatives.
Security researcher Yue Liu responsibly disclosed a command injection vulnerability affecting the Spring CLI VS Code extension, version 0.9.0 and earlier. The flaw could allow arbitrary command execution on a developer's machine through crafted project content or files.
The Spring CLI extension for Visual Studio Code reached end-of-life and became unsupported. Later advisories noted that communication around the EOL status could have been better.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spring disclosed and national cyber agencies amplified six vulnerabilities in **Spring Tools** that affect developer environments for the Spring Java ecosystem, including **Spring Tools for Eclipse 5.2.0 and earlier** and **Spring Tools for VSCode, Cursor, and Theia 2.2.0 and earlier**. The most serious issues include **`CVE-2026-47858`**, which can expose Spring Boot applications started with live information mode to **JMX-based remote code execution**, and **`CVE-2026-47873`**, where the Boot Dashboard Docker integration publishes unauthenticated **JDWP** and **JMX** ports on **`0.0.0.0`** instead of limiting access to loopback, potentially exposing container control interfaces to the network. A third high-severity flaw, **`CVE-2026-47882`**, weakens Spring Boot DevTools remote restart authentication by generating the shared secret with a non-cryptographic pseudo-random number generator. Advisories also cited additional issues involving **plaintext logging of proxy credentials**, **cleartext storage of remote secrets**, and a **cross-site scripting** vulnerability. Italy's ACN and the Canadian Centre for Cyber Security said updates are available or pending through Spring security bulletins, with fixed versions identified as **Spring Tools for Eclipse 5.3.0** and **Spring Tools for VSCode, Cursor, and Theia 2.3.0**, and urged organizations to upgrade affected tooling.
Jul 30, 2026
Security researchers at **Ox Security** reported multiple high-to-critical vulnerabilities in widely used *Visual Studio Code* extensions—collectively exceeding **128 million downloads**—that could enable **local file exfiltration** and **code execution** in developer environments. The issues highlighted include **Live Server** (**CVE-2025-65717**), **Code Runner** (**CVE-2025-65715**, referenced in reporting but not included as a CVE entry here), **Markdown Preview Enhanced** (**CVE-2025-65716**), and *Microsoft Live Preview* (no CVE cited in the reporting). Ox Security stated it attempted disclosure starting in June 2025 but did not receive responses from maintainers, warning that exploitation could support **lateral movement**, **data theft**, and **system takeover** in corporate networks where developer workstations are a pivot point. The CVE records included in this set describe two of the extension flaws in more detail: **CVE-2025-65717** (Live Server v5.7.9) allows attackers to **exfiltrate files** when a user interacts with a crafted HTML page, and **CVE-2025-65716** (Markdown Preview Enhanced v0.8.18) can lead to **arbitrary code execution** via a crafted `.md` file (user interaction required). Other items in the feed are unrelated, covering a broad mix of independent vulnerabilities (e.g., Tenable Security Center command injection, LightLLM unsafe deserialization RCE, libvpx heap overflow affecting Firefox/Thunderbird, and multiple router/IoT hard-coded credential and command-injection issues) and should not be treated as part of the VSCode-extension disclosure story.
Jun 29, 2026
Security researchers at **OX Security** disclosed multiple vulnerabilities across widely used Microsoft Visual Studio Code extensions—**Live Server**, **Code Runner**, **Markdown Preview Enhanced**, and **Microsoft Live Preview**—with combined installs reported at **125–128 million**. The issues enable attacks ranging from **local file exfiltration** to **arbitrary code/JavaScript execution**, and highlight how a single vulnerable or malicious extension can be leveraged for broader compromise and potential lateral movement in developer environments. Reported flaws include **CVE-2025-65717** (Live Server; CVSS 9.1) enabling local file theft by luring a developer to a malicious site while the extension’s local server is running (e.g., `localhost:5500`), **CVE-2025-65716** (Markdown Preview Enhanced; CVSS 8.8) allowing arbitrary JavaScript execution via a crafted `.md` file with subsequent local port enumeration and exfiltration, and **CVE-2025-65715** (Code Runner; CVSS 7.8) enabling code execution by tricking users into modifying `settings.json`. Separate reporting on **Microsoft Live Preview** describes a **one-click reflected XSS** and unauthenticated request abuse against the extension’s local development server to enumerate and exfiltrate sensitive files (e.g., `.env`, API keys, source code); this Live Preview issue was reported as patched in version **0.4.16** via input sanitization (e.g., an `escapeHTML` function), while other extension issues were described as **unpatched** at the time of reporting.
Jun 29, 2026