Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
HighPublic exploit

Arbitrary Code Execution in VS Code Code Runner via crafted workspace executorMap

IdentifiersCVE-2025-65715CWE-94· Improper Control of Generation of…

CVE-2025-65715 affects the Visual Studio Code extension Code Runner, specifically version 0.12.2 per the provided advisory context, with reporting that the weakness may affect all versions. The issue is in handling of the code-runner.executorMap setting. An attacker can supply a crafted workspace or otherwise influence VS Code workspace/settings content so that Code Runner builds and executes an attacker-controlled command. In practice, this is a command-injection/arbitrary code execution condition triggered when the victim opens a malicious workspace and uses the extension in that context. The vulnerable behavior stems from trusting configuration-derived command data and passing it into execution flow without sufficient validation or hardening.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation results in arbitrary code execution on the developer workstation in the context of the user running VS Code. This can enable full compromise of the local development environment, including execution of attacker commands, access to source code and local files, theft of credentials, API keys, and configuration data, installation of persistence mechanisms, and use of the developer machine as a pivot for lateral movement into connected internal systems.

Mitigation

If you can’t patch tonight, do this now.

Do not open untrusted workspaces or repositories with Code Runner installed. Treat workspace settings and repository-provided .vscode/settings.json as untrusted input and review them with the same rigor as code changes. Avoid pasting configuration snippets from email, chat, or unverified repositories into settings.json. Use VS Code Workspace Trust or equivalent controls to restrict extension behavior in untrusted workspaces, and enforce extension allowlisting or disable non-essential extensions in enterprise environments until a fix is available.

Remediation

Patch, then assume compromise.

Upgrade Code Runner to a vendor-fixed release that addresses CVE-2025-65715 when such a version is available. If no patched version is available, uninstall or disable the Code Runner extension. Review and remove untrusted or unexpected code-runner.executorMap entries from user and workspace settings, including .vscode/settings.json, and audit repositories for malicious workspace configuration committed to source control.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
FormulahendryCoderunnerapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity7

Community discussion across Reddit, Mastodon, and other social sources.