CVE-2025-8217

Medium

Description

The Amazon Q Developer Visual Studio Code (VS Code) extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syntax error which prevents it from making a successful API call to the Q Developer CLI. To mitigate this issue, users should upgrade to version v1.85.0. All installations of v1.84.0 should be removed from use.

SeverityMedium

CVSS4.0

Exploit probability—

ProductQ Developer VS Code Extension

PublishedJul 30, 2025

First seenJul 30, 2025

Weakness typeCWE-506CWE-506

How to fix

Update

Amazon Q Developer VS Code Extension1.85.0 or later

Patches

github.com/aws/aws-toolkit-vscode/releases/tag/amazonq%2Fv1.85.0

Vendor advisories

aws.amazon.com/security/security-bulletins/AWS-2025-015/

Affected products

Product	Affected versions	Fixed in
Amazon Q Developer VS Code Extension	1.84.0 ≤ v < 1.85.0, sha256:47f7840ecab6312d2733e1274c513050405886c70f2037fb2f1e9099872b0464	1.85.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.