CVE-2025-8217

Katalog CVE

CVSS 4.0 · Medium EPSS 0,21%

Kerentanan Embedded Malicious Code. Skor CVSS 3.1 4.0 (Medium) menurut CNA.

Deskripsi (NVD)

The Amazon Q Developer Visual Studio Code (VS Code) extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syntax error which prevents it from making a successful API call to the Q Developer CLI. To mitigate this issue, users should upgrade to version v1.85.0. All installations of v1.84.0 should be removed from use.

Rincian

Terbit di NVD

30 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

4.0 (Medium), sumber CNA
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-506: Embedded Malicious Code

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 9,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://aws.amazon.com/security/security-bulletins/AWS-2025-015/
• https://github.com/aws/aws-toolkit-vscode/releases/tag/amazonq%2Fv1.85.0
• https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-7g7f-ff96-5gcw