OX Security Finds Vulnerabilities in VS Code Extensions

Cybersecurity researchers at OX Security have uncovered four vulnerabilities in popular extensions for Microsoft Visual Studio Code, a widely used code editor, potentially allowing attackers to steal files, execute code remotely, and compromise developer machines. The flaws, affecting extensions with more than 128 million combined downloads, were detailed in a report released on February 17, with three receiving official identifiers from MITRE the previous day.

The vulnerabilities impact Live Server, which has 72 million downloads and enables local web servers for previews; Code Runner, with 37 million downloads for executing code snippets; Markdown Preview Enhanced, downloaded 8.5 million times for rendering markdown files; and Microsoft Live Preview, with 11 million downloads for browser previews. These extensions also affect Cursor and Windsurf, AI-assisted development tools built on VS Code's framework. Rated critical or high severity, the issues carry CVSS scores ranging from 7.8 to 9.1.

In Live Server, identified as CVE-2025-65717, attackers could exploit an exposed local server reachable from any webpage, enabling remote file exfiltration if a developer clicks a malicious...