CVE-2025-65717

PoC —

CVSS 3.1

4.3 medium

EPSS

<1%p44

Published

Feb 16, 2026 (Feb 16, 2026)

Modified

Jun 17, 2026

Description

An issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML page.

Vendors: ritwickdey
Products: live server
Weakness: CWE-79, CWE-200, CWE-601
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news4 stories

⚡ Weekly Recap: Double-Tap Skimmers, PromptSpy AI, 30Tbps DDoS, Docker Malware & More

The Hacker NewsFeb 26, 11:25 UTC · Feb 26, 2026Malware CVE-2026-22769 CVE-2026-25926 CVE-2026-26119+32 CVEs

60

Flaws in Popular IDE Extensions Allow Data Exfiltration

Infosecurity MagazineFeb 19, 10:45 UTC · Feb 19, 2026Vulnerability CVE-2025-65717 CVE-2025-65716 CVE-2025-65715

60

VS Code extensions with 125M+ installs expose users to cyberattacks

Security AffairsFeb 18, 15:14 UTC · Feb 18, 2026Vulnerability CVE-2025-65715 CVE-2025-65716 CVE-2025-65717

60

Critical Flaws Found in Four VS Code Extensions with Over 125 Million Installs

The Hacker NewsFeb 18, 13:16 UTC · Feb 18, 2026Vulnerability CVE-2025-65717 CVE-2025-65716 CVE-2025-65715

60