Loading vulnerability…
CVE-2025-65717 is a critical vulnerability in the Visual Studio Code Live Server extension, reported against version 5.7.9 and described by multiple sources as affecting all versions. The flaw stems from missing or insufficient cross-origin protections on the local HTTP server exposed by the extension, commonly bound to localhost for previewing project files. When Live Server is running, an attacker-controlled web page opened in the victim’s browser can issue cross-origin requests to the local server and read responses that should not be accessible to an external origin. This enables browsing and retrieval of files exposed through the developer’s local preview environment, followed by exfiltration of the collected data to attacker-controlled infrastructure. Exploitation does not require authentication to the local server, but it does rely on the victim visiting a crafted web page while the extension’s local server is active.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository purpose: a GitHub Pages, browser-executed proof-of-concept named “Live Server Evil Crawler” demonstrating CVE-2025-65717 (VSCode Live Server extension allowing requests from any origin). The PoC shows how a malicious web page can interact with a localhost Live Server instance and read exposed content. Structure: - README.md: describes the vulnerability, features (port scanner + crawler), and links to the hosted demo and the Ox Security article. - index.html: UI for selecting a port range to scan (default 5000–6000) and a manual port input; loads index.js. - index.js: core logic. Key capabilities (index.js): - Localhost port scanning: scanPorts() probes http://localhost:<port>/ across a user-specified range using fetch(..., mode:'no-cors') with a 12s timeout and concurrency batching (batchSize=100). Any port that responds is listed with a “crawl” button. - Recursive crawling and content retrieval: startCrawl(port) sets origin=http://localhost:<port>, clears prior results, and calls crawl(origin+'/'). crawl() fetches a URL, records it, and if the response is HTML, parses it and follows <a href> links recursively (joinPath resolves relative/absolute links). report() creates a UI entry; when expanded, it fetches the resource again and displays text/* bodies, otherwise labels it as binary with the detected content-type. Overall, this is an operational browser-based PoC demonstrating cross-origin access to a localhost development server, enabling discovery of the server and exfiltration/reading of served files via recursive link traversal.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Critical file exfiltration vulnerability in the VSCode Live Server extension caused by missing CORS protections on the local HTTP server, allowing unauthenticated remote access to developer files via localhost.
A critical remote file exfiltration vulnerability in the VS Code 'Live Server' extension leveraging localhost functionality to exfiltrate files from a developer machine; affects all versions.
Local file discovery/exfiltration risk in the VS Code Live Server extension due to insufficient cross-origin protections, allowing a malicious webpage to interact with the developer’s localhost Live Server and retrieve served content.
A high-severity vulnerability in the VS Code Live Server extension enabling remote file exfiltration from the developer environment/host.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.