CVE-2025-8217Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension

Description

The Amazon Q Developer Visual Studio Code (VS Code) extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syntax error which prevents it from making a successful API call to the Q Developer CLI. To mitigate this issue, users should upgrade to version v1.85.0. All installations of v1.84.0 should be removed from use.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://aws.amazon.com/security/security-bulletins/AWS-2025-015/ vendor-advisory
• https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-7g7f-ff96-5gcw third-party-advisory
• https://github.com/aws/aws-toolkit-vscode/releases/tag/amazonq%2Fv1.85.0 patch