The short answer
CVE-2025-52882 (GitHub advisory GHSA-9f65-56v6-gxw7, high, CVSS 8.8): Claude Code’s extensions for VS Code and its forks (such as Cursor, Windsurf and VSCodium) and for JetBrains IDEs accepted WebSocket connections from any origin, so an attacker-controlled web page could connect to them. In VS Code, that could let a page read arbitrary files, see open files, get selection and diagnostics events, or run code in limited situations involving an open Jupyter notebook and an accepted malicious prompt. Affected: the VS Code extension 0.2.116 to 1.0.23 and the JetBrains plugin 0.1.1 to 0.1.8 (beta). Fixed: 1.0.24 and 0.1.9, patched on 13 June 2025.1
If your editor’s Claude Code extension is older than those versions, update it.
Deedglass
A tool call meets your rules before it runs
Asks to run
DELETE FROM visits;
Deletes every row in visits
Deedglass checks your rules
- Reading dataAllowed
- Deleting a whole table (DROP, TRUNCATE)Never
- Changing or deleting rows without saying which (WHERE)This one
- Other changesWait for a person
What the advisory says
| Field | Value |
|---|---|
| Advisory | GHSA-9f65-56v6-gxw7, CVE-2025-52882 |
| Severity | High, CVSS 8.8 |
| VS Code and forks | Claude Code for VSCode, versions 0.2.116 to 1.0.23; fixed in 1.0.24 |
| JetBrains IDEs | Claude Code [Beta], 0.1.1 to 0.1.8; fixed in 0.1.9 |
| Trigger | Visiting an attacker-controlled web page |
| VS Code impact | Read arbitrary files, list open files, selection and diagnostics events; code execution only with an open Jupyter notebook and an accepted malicious prompt |
| JetBrains impact | Selection events, open files, syntax errors |
| Patch released | 13 June 2025 |
All from the advisory.1 It also notes that Claude Code auto-updates itself and its extensions on launch, and still asks users to check the extension version and restart the IDE.1
Why a web page could reach it
The advisory describes the extensions accepting WebSocket connections from arbitrary origins.1 A listener like that is reachable by anything on your machine that can connect to a local port, including your browser, and your browser runs code from every page you visit. A server that doesn’t check the Origin header of incoming connections can’t tell the CLI from a web page.
This is the same class of issue the MCP spec warns about for local HTTP servers: servers must validate Origin on all incoming connections to prevent DNS rebinding, and should bind to localhost and authenticate connections.3 Our post on local MCP server security shows the three checks in a small server, with curl results.
Check and update
From the advisory’s own steps:1
VS Code, Cursor, Windsurf, VSCodium and other forks
- Open the Extensions view.
- Find Claude Code for VSCode.
- If the version is below 1.0.24, update or uninstall it.
- Restart the IDE.
JetBrains IDEs (IntelliJ, PyCharm, Android Studio and others)
- Open the Plugins list.
- Find Claude Code [Beta].
- If the version is below 0.1.9, update or uninstall it.
- Restart the IDE.
Editors that stay open for weeks may keep running an old extension until restarted, which is why the restart step matters.
The pattern across 36 advisories
The anthropics/claude-code repository lists 36 security advisories as of 26 October 2026: 29 high, 4 medium and 3 low.2 We grouped them by title (first match wins; the grouping is ours):
| Pattern | Count | Examples from the titles |
|---|---|---|
| Command validation or approval-prompt bypass | 8 | Injection through echo, rg, sed, find, directory changes, zsh clobbering |
| Trust dialog or repository configuration acting before trust | 6 | Command execution before the startup trust dialog; settings files and git worktrees spoofing trust |
| Symlink, path and race issues | 6 | Path prefixes colliding; deny rules bypassed through symlinks; write-time symlink races |
| Sandbox escape | 3 | Via settings.json, symlink following, git worktree path confusion |
| Network and exfiltration | 3 | A permissive default allowlist; domain validation bypass; a pre-approved domain used for exfiltration |
| IDE extension connection | 1 | This CVE |
| Other | 9 | Malicious git configuration and executables, plugin pinning, Windows privilege escalation, SSH host keys |
Counts from the advisory list.2 Two lessons line up with what we found in Cursor’s 33 advisories:
- Text-based command checks keep getting bypassed. Eight advisories found shell syntax that slipped past command validation. Rules on command text are a second check; the sandbox and narrow credentials are the first.
- Repositories try to configure the agent before you’ve trusted them. Six advisories concern things a cloned repository could do before or around the trust dialog. Treat a new repository’s agent files as untrusted code until you’ve read them.
A path-prefix bug appears here too: the August 2025 “path restriction bypass … when path prefixes collide” is the same class as the filesystem MCP server’s 2025 advisory. Our filesystem MCP post shows why a startsWith check fails, in four lines of output.
What this means for your setup
- Keep agents and their extensions current, and restart long-running editors after updates.
- Turn the sandbox on. Several of these advisories are about getting past checks that the sandbox doesn’t rely on. Our Claude Code sandbox post has a starting configuration.
- Set policy centrally so a repository can’t loosen it, with managed settings.
- Keep secrets off developer machines where you can. An extension that leaks files leaks less when there’s less to read.
To see what the agents configured on your machine could change without a prompt, paste the config into the check page or run npx deedglass scan (how the grade works); to try tool-call rules in your browser, open the playground.
Questions people ask
Which Claude Code extension versions are affected by CVE-2025-52882?
The VS Code extension 0.2.116 to 1.0.23, and the JetBrains plugin 0.1.1 to 0.1.8 (beta).1
Was the fix automatic?
The advisory says Claude Code auto-updates itself and its extensions on launch, and still asks you to check the version and restart the IDE.1
Does this affect Cursor and Windsurf?
Yes, through the Claude Code for VSCode extension installed in them; the advisory names VS Code forks such as Cursor, Windsurf and VSCodium.1
Written with AI assistance and checked against our claims register.