Critical VS Code Extension Flaws Enable Code Execution and Data Exfiltration

Researchers disclosed multiple high-severity vulnerabilities in widely used Visual Studio Code extensions, including Live Server, Markdown Preview Enhanced, Code Runner, and Microsoft Live Preview, exposing developers to local file theft, cross-site scripting, data exfiltration, and remote code execution. Three issues were assigned identifiers CVE-2025-65715, CVE-2025-65716, and CVE-2025-65717, with separate disclosures highlighting flaws in Markdown Preview Enhanced and Live Server.

The most severe issue, CVE-2025-65717 in Live Server, could allow a remote unauthenticated attacker to exfiltrate files from a developer workstation through localhost access if the victim opens a malicious website. Security guidance accompanying the disclosures urged organizations to update affected VS Code extensions to fixed versions, restrict installed extensions to those that are necessary, and prefer trusted publishers to reduce developer workstation exposure.