Medium severity4.0NVD Advisory· Published Jul 30, 2025· Updated Apr 15, 2026

CVE-2025-8217

Description

The Amazon Q Developer Visual Studio Code (VS Code) extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syntax error which prevents it from making a successful API call to the Q Developer CLI.

To mitigate this issue, users should upgrade to version v1.85.0. All installations of v1.84.0 should be removed from use.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

AWS/AWS Toolkit Vscodereferences
Amazon/Amazon Q Developerllm-create
Range: =1.84.0

Patches

Vulnerability mechanics

References

aws.amazon.com/security/security-bulletins/AWS-2025-015/nvd
github.com/aws/aws-toolkit-vscode/releases/tag/amazonq%2Fv1.85.0nvd
github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-7g7f-ff96-5gcwnvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000