PT-2025-31362 · Amazon+1 · Amazon Q Developer Visual Studio Code Extension+1
CVSS v4.0
5.1
Medium
| Vector | AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Amber |
Name of the Vulnerable Software and Affected Versions
Amazon Q Developer Visual Studio Code (VS Code) extension version 1.84.0
Description
The Amazon Q Developer Visual Studio Code (VS Code) extension v1.84.0 contains injected code intended to call the Q Developer CLI. This code executes upon extension launch but contains a syntax error, preventing a successful API call.
Recommendations
Upgrade to version 1.85.0.
Remove all installations of version 1.84.0.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Amazon Q Developer Visual Studio Code Extension
Visual Studio Code