Executive Summary
In February 2026, critical vulnerabilities were discovered in four widely used Visual Studio Code (VS Code) extensions—Live Server, Code Runner, Markdown Preview Enhanced, and Microsoft Live Preview—collectively installed over 125 million times. These flaws could allow attackers to steal local files and execute remote code by exploiting weaknesses in the extensions' handling of web content and local server configurations. Notably, CVE-2025-65717 in Live Server enables file exfiltration via malicious websites, while CVE-2025-65716 in Markdown Preview Enhanced permits arbitrary code execution through crafted markdown files. Despite disclosure in June 2025, three of these vulnerabilities remained unpatched as of February 2026, leaving developers exposed to significant security risks. (thehackernews.com)
This incident underscores the escalating threat of supply chain attacks targeting development environments. The exploitation of trusted tools like VS Code extensions highlights the need for developers to exercise caution when installing and updating extensions, and for maintainers to prioritize timely security patches to mitigate potential compromises.
Why This Matters Now
The discovery of these vulnerabilities in widely used VS Code extensions highlights the urgent need for developers to scrutinize third-party tools and for extension maintainers to address security flaws promptly. As supply chain attacks become more prevalent, ensuring the integrity of development environments is critical to prevent potential data breaches and system compromises.
Attack Path Analysis
Attackers exploited vulnerabilities in popular VS Code extensions to execute arbitrary code and exfiltrate sensitive files. By tricking developers into opening crafted markdown files or visiting malicious websites, they gained initial access. Subsequently, they escalated privileges by manipulating extension settings or exploiting the IDE's capabilities. The attackers then moved laterally within the development environment, leveraging compromised extensions to access additional systems. They established command and control channels through IDE tunneling features, maintaining persistent access. Sensitive data was exfiltrated via the compromised extensions, and the impact included potential compromise of entire organizations due to the widespread use of these extensions.
Kill Chain Progression
Initial Compromise
Description
Attackers tricked developers into opening malicious markdown files or visiting crafted websites, exploiting vulnerabilities in VS Code extensions to execute arbitrary code.
Related CVEs
CVE-2025-65717
CVSS 4.3An issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML page.
Affected Products:
Ritwick Dey Live Server – 5.7.9
Exploit Status:
no public exploitCVE-2025-65716
CVSS 8.8An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .md file.
Affected Products:
Yiyi Wang Markdown Preview Enhanced – 0.8.18
Exploit Status:
no public exploitCVE-2025-65715
CVSS 7.8An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace.
Affected Products:
Jun Han Code Runner – 0.12.2
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
IDE Extensions
Exploitation for Client Execution
Exploitation for Defense Evasion
IDE Tunneling
Exploitation for Privilege Escalation
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Asset Management
Control ID: 2.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical supply-chain vulnerabilities in VS Code extensions expose software development environments to code execution, file exfiltration, and lateral movement attacks across organizations.
Information Technology/IT
IT infrastructure faces immediate risk from compromised development tools enabling attackers to access sensitive systems through vulnerable localhost services and extension exploitation.
Financial Services
Banking systems vulnerable through developer workstations using affected extensions, risking compliance violations under PCI DSS and potential data exfiltration of financial information.
Health Care / Life Sciences
Healthcare development environments exposed to HIPAA compliance breaches through extension vulnerabilities allowing unauthorized access to protected health information and medical systems.
Sources
- Critical Flaws Found in Four VS Code Extensions with Over 125 Million Installshttps://thehackernews.com/2026/02/critical-flaws-found-in-four-vs-code.htmlVerified
- NVD - CVE-2025-65717https://nvd.nist.gov/vuln/detail/CVE-2025-65717Verified
- NVD - CVE-2025-65716https://nvd.nist.gov/vuln/detail/CVE-2025-65716Verified
- NVD - CVE-2025-65715https://nvd.nist.gov/vuln/detail/CVE-2025-65715Verified
- IDE Extension Vulnerabilities Expose Massive Security Blind Spothttps://www.ox.security/blog/four-vulnerabilities-expose-a-massive-security-blind-spot-in-ide-extensions/Verified
- vscode-livepreview/CHANGELOG.md at main · microsoft/vscode-livepreview · GitHubhttps://github.com/microsoft/vscode-livepreview/blob/main/CHANGELOG.mdVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it embeds security directly into the cloud fabric, potentially reducing the attacker's ability to exploit vulnerabilities in development environments and limiting lateral movement within the network.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to execute arbitrary code through compromised extensions would likely be constrained, reducing the initial foothold within the development environment.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges within the development environment would likely be limited, reducing the scope of unauthorized access.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally within the development environment would likely be restricted, limiting access to additional systems and resources.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish and maintain command and control channels would likely be constrained, reducing persistent unauthorized access.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data would likely be limited, reducing the risk of data loss.
The overall impact of the attack would likely be reduced, limiting the potential compromise of entire organizations.
Impact at a Glance
Affected Business Functions
- Software Development
- Code Review
- Quality Assurance
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of sensitive source code, API keys, and configuration files.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict extension permissions and limit potential lateral movement.
- • Enforce Egress Security & Policy Enforcement to monitor and control outbound traffic from development environments.
- • Utilize Threat Detection & Anomaly Response to identify and respond to suspicious activities within IDEs.
- • Apply Inline IPS (Suricata) to detect and prevent exploitation attempts targeting known vulnerabilities.
- • Regularly update and audit IDE extensions to ensure they are free from vulnerabilities and unauthorized modifications.
