PT-2026-8356 · Unknown · Visual Studio Code Live Server

Published 2026-02-16 · Updated 2026-02-25 · CVE-2025-65717

Positive Technologies · (AI Summary)

CVSS v2.0

5.0

Medium

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Visual Studio Code Live Server version 5.7.9

Description An issue in Visual Studio Code Live Server allows attackers to exfiltrate files through user interaction with a specially crafted HTML page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Open Redirect

Information Disclosure

Weakness Enumeration

CWE-79

CWE-601

CWE-200

Related Identifiers

BDU:2026-02194

CVE-2025-65717

Affected Products

Visual Studio Code Live Server

References · 21

• 🔥 https://ox.security/blog/cve-2025-65717-live-server-vscode-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2025-65717 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02194 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-65717 · Security Note
• https://github.com/ritwickdey/vscode-live-server · Note
• https://twitter.com/MosheTov/status/2023886646899601743 · Twitter Post
• https://twitter.com/autumn_good_35/status/2024171367017693603 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1r9sfwr/top_10_trending_cves_20022026 · Reddit Post
• https://twitter.com/ThreatSynop/status/2024379944663732699 · Twitter Post
• https://t.me/true_secator/7930 · Telegram Post
• https://twitter.com/grok/status/2024453632024879596 · Twitter Post
• https://twitter.com/ThreatSynop/status/2024254499909448191 · Twitter Post
• https://t.me/cveNotify/153214 · Telegram Post
• https://twitter.com/SecAlertsCo/status/2023922736993890597 · Twitter Post
• https://twitter.com/jbhall56/status/2024117407837479120 · Twitter Post