Ox Security disclosures of high-severity vulnerabilities in popular VSCode extensions

Security researchers at Ox Security reported multiple high-to-critical vulnerabilities in widely used Visual Studio Code extensions—collectively exceeding 128 million downloads—that could enable local file exfiltration and code execution in developer environments. The issues highlighted include Live Server (CVE-2025-65717), Code Runner (CVE-2025-65715, referenced in reporting but not included as a CVE entry here), Markdown Preview Enhanced (CVE-2025-65716), and Microsoft Live Preview (no CVE cited in the reporting). Ox Security stated it attempted disclosure starting in June 2025 but did not receive responses from maintainers, warning that exploitation could support lateral movement, data theft, and system takeover in corporate networks where developer workstations are a pivot point.

The CVE records included in this set describe two of the extension flaws in more detail: CVE-2025-65717 (Live Server v5.7.9) allows attackers to exfiltrate files when a user interacts with a crafted HTML page, and CVE-2025-65716 (Markdown Preview Enhanced v0.8.18) can lead to arbitrary code execution via a crafted .md file (user interaction required). Other items in the feed are unrelated, covering a broad mix of independent vulnerabilities (e.g., Tenable Security Center command injection, LightLLM unsafe deserialization RCE, libvpx heap overflow affecting Firefox/Thunderbird, and multiple router/IoT hard-coded credential and command-injection issues) and should not be treated as part of the VSCode-extension disclosure story.