CVE-2025-8217highSupply chain2025-07-23
CVE-2025-8217: malicious code shipped in Amazon Q Developer 1.84.0
An over-scoped GitHub token in Amazon Q’s build setup let an attacker commit malicious code that shipped in the VS Code extension 1.84.0. AWS says it failed to run due to a syntax error.
What it is
AWS bulletin (23 July 2025): the threat actor used an inappropriately scoped token in the CodeBuild configuration to commit code to the extension’s open-source repo, which was automatically included in a release.
AWS revoked the credentials, removed the code and released 1.85.0.
How to check
- In VS Code, check the Amazon Q Developer extension version.
How to fix
- Update to 1.85.0 or later.
code --list-extensions --show-versions | grep -i amazon