The Hacker - ⚠️ Four popular VS Code extensions expose developers to file theft ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in VS Code Extensions Expose Developers to Attacks Multiple vulnerabilities affecting popular Visual Studio Code (VS Code) extensions, including the Live Preview extension, have been discovered, exposing developers to risks such as local file exfiltration and remote code execution. The flaws, identified by researchers from OX Security, impact extensions with over 128 million downloads. Key vulnerabilities include CVE-2025-65715, CVE-2025-65716, and CVE-2025-65717, all published on February 16, 2026. 18 sources 26