CVE-2025-52882: Claude Code IDE extensions allow unauthorized websocket connections

Summary

CVE-2025-52882 affects Claude Code extensions for VSCode and its forks, such as Cursor, Windsurf, and VSCodium, as well as the JetBrains plugin Claude Code [Beta]. Visiting attacker-controlled webpages lets an attacker make unauthorized websocket connections to the IDE. Exploitation can read arbitrary files, list open files, and obtain selection and diagnostics events, and in VSCode it can also execute code in limited cases involving an open Jupyter Notebook and an accepted malicious prompt.

Mitigation

Claude released a patch on June 13, 2025. For VSCode and forks, update or uninstall Claude Code for VSCode versions prior to 1.0.24, then restart the IDE. For JetBrains IDEs, update or uninstall Claude Code [Beta] versions prior to 0.1.9, then restart the IDE.

Topics

• AI agents

Related items

• HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSame vendor · NVD/CVE Database
• HighCVE-2026-88066: Claude Desktop on Windows git.exe execution via search pathSame vendor · NVD/CVE Database
• HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSame vendor · NVD/CVE Database
• MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database
• MediumGHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesSame vendor · GitHub Advisory Database