CVE-2025-65715

HighPublic PoC

Published: 16 February 2026

Published

16 February 2026

Modified

25 February 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0004 11.7th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-65715 is a high-severity Code Injection (CWE-94) vulnerability in Formulahendry Coderunner. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 11.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and CM-11 (User-installed Software).

Threat & Defense at a Glance

What attackers do: exploitation maps to Malicious File (T1204.002) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Flaw remediation requires timely patching of the Code Runner extension vulnerability, directly preventing arbitrary code execution from crafted workspaces.

CM-11 User-installed Software good match

prevent

User-installed software controls enforce policies to restrict or approve installation of vulnerable VS Code extensions like Code Runner v0.12.2.

CM-10 Software Usage Restrictions good match

prevent

Software usage restrictions via whitelisting prevent execution of arbitrary injected code spawned by the exploited executorMap setting.

MITRE ATT&CK Enterprise TechniquesAI

T1204.002 Malicious File Execution

An adversary may rely upon a user opening a malicious file in order to gain execution.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Code injection in VS Code workspace setting enables RCE on opening malicious file (T1204.002), resulting in arbitrary command execution (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace.

Deeper analysisAI

CVE-2025-65715 is a code injection vulnerability (CWE-94) in the code-runner.executorMap setting of the Visual Studio Code extension Code Runner version 0.12.2. Published on 2026-02-16, it allows attackers to execute arbitrary code when a user opens a crafted workspace file, earning a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

The attack requires local access to the victim's machine and user interaction, such as opening a maliciously crafted Visual Studio Code workspace. No privileges are needed, and the attack complexity is low. Successful exploitation enables arbitrary code execution with high impacts on confidentiality, integrity, and availability.

Mitigation details are available in the extension's GitHub repository at https://github.com/formulahendry/vscode-code-runner and the OX Security blog advisory at https://www.ox.security/blog/cve-2025-65715-code-runner-vscode-rce/.