Executive brief
Claude Code is an AI-powered coding assistant extension for popular IDEs like VSCode and JetBrains. A vulnerability allows attackers to establish unauthorized websocket connections when users visit malicious webpages, enabling attackers to read source files, view open projects, and in some cases execute arbitrary code without the user's knowledge.
Technical details
Claude Code IDE extensions fail to properly validate the origin of websocket connections, allowing connections from arbitrary web origins. An attacker can craft a malicious webpage that, when visited by a user with Claude Code installed, establishes an unauthorized websocket connection to the IDE extension. In VSCode/forks, this grants access to read arbitrary files, enumerate open files, capture editor selection and diagnostic events, and execute code within Jupyter Notebooks if the user confirms a prompt. In JetBrains IDEs, attackers can retrieve selection events, file lists, and syntax errors. The vulnerability requires user interaction (visiting a malicious site) but no authentication. Patches were released on June 13, 2025: VSCode extension version 1.0.24+ and JetBrains plugin version 0.1.9+ close this vulnerability.
Affected products
- Anthropic Claude Code for VSCode 0.2.116 through 1.0.23
- Anthropic Claude Code 0.1.1 through 0.1.8
Timeline
- 2025-06-13: patched: Patch released for VSCode (1.0.24+) and JetBrains (0.1.9+)
- 2025-06-23: disclosed: GHSA-9f65-56v6-gxw7 published
- 2025-06-24: advisory: CVE-2025-52882 published on NVD