CVE-2025-65715
📋 TL;DR
CVE-2025-65715 is a remote code execution vulnerability in Visual Studio Code's Code Runner extension that allows attackers to execute arbitrary code when users open a malicious workspace. This affects developers using the vulnerable Code Runner extension version. The vulnerability exploits improper handling of the code-runner.executorMap setting.
💻 Affected Systems
- Visual Studio Code Code Runner Extension
📦 What is this software?
Coderunner by Formulahendry
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, steal credentials, pivot to other systems, and maintain persistent access.
Likely Case
Attackers execute malicious code in the context of the user opening the workspace, potentially stealing development credentials, source code, or deploying ransomware.
If Mitigated
Limited impact if extension is disabled or patched, though malicious workspace could still cause denial of service.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious workspace). Proof of concept available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.12.3 or later
Vendor Advisory: https://github.com/formulahendry/vscode-code-runner/security/advisories
Restart Required: Yes
Instructions:
1. Open Visual Studio Code. 2. Go to Extensions view (Ctrl+Shift+X). 3. Search for 'Code Runner'. 4. Click Update button or uninstall/reinstall latest version. 5. Restart VS Code.
🔧 Temporary Workarounds
Disable Code Runner Extension
allTemporarily disable the vulnerable extension until patched.
code --disable-extension formulahendry.code-runner
Restrict Workspace Files
allOnly open workspace files from trusted sources.
🧯 If You Can't Patch
- Disable the Code Runner extension completely
- Implement application allowlisting to prevent execution of unknown binaries
🔍 How to Verify
Check if Vulnerable:
Check Code Runner extension version in VS Code Extensions view. If version is 0.12.2 or earlier, you are vulnerable.Check Version:
code --list-extensions --show-versions | findstr code-runnerVerify Fix Applied:
Verify Code Runner extension version is 0.12.3 or later in Extensions view.📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from VS Code
- Suspicious command execution in terminal
- Unexpected network connections from code processes
Network Indicators:
- Outbound connections to unknown IPs from VS Code process
- DNS queries for suspicious domains
SIEM Query:
process_name:vscode* AND (process_command_line:*workspace* OR process_command_line:*code-runner*)