CVE-2025-65715 Details
Description
An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace.
A vulnerability allowing arbitrary code execution has been identified in the Visual Studio Code extension Code Runner, specifically in version 0.12.2. The issue arises from the extension's code-runner.executorMap setting, which can be manipulated to execute unauthorized commands when a crafted workspace is opened. This vulnerability exploits unsafe command execution practices by using Node.js's child_process.spawn() with the shell: true option, allowing attackers to inject commands through user-controllable configuration settings.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/formulahendry/vscode-code-runner | [email protected] | Exploit |
| https://www.ox.security/blog/cve-2025-65715-code-runner-vscode-rce/ | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| formulahendry coderunner | >= 0.12.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | Initial Analysis | [email protected] |
| Feb 18, 2026 | CVE Modified | CISA-ADP |
| Feb 16, 2026 | New CVE Received | [email protected] |