IDE "Open Folder" RCE Proof of Concept Package

This package contains three examples of the "Open Folder" vulnerability (CVE-2025-54135 equivalent) affecting VS Code, Cursor, and other derived IDEs.

Payload: All examples launch calc.exe (Windows) or Calculator (Mac/Linux) to demonstrate execution without causing harm.

1_Basic_Calc

The simplest test case.

Behavior: Opens calc.exe immediately upon opening the folder.
Stealth: None. A terminal window will likely appear.
Use Case: Basic verification of vulnerability.

2_Inline_Stealth

Demonstrates obfuscation within the configuration file.

Behavior: Launches calc.exe silently in the background.
Technique: Uses the windows property override to hide the real command behind a fake echo command. The payload is Base64 encoded.
Stealth: High (UI level). No terminal pops up.

3_External_Script_Stealth

Demonstrates the "Loader" technique.

Behavior: tasks.json triggers a standard looking Python script (scripts/setup.py).
Technique: The malice is decoupled from the config file. The config looks like a standard build instruction.
Stealth: Maximum (Social Engineering). Looks like a legitimate repository setup.

Usage

Extract the folder you want to test.
Open your IDE.
File -> Open Folder... -> Select the folder (e.g., 1_Basic_Calc).
Observe if Calculator launches.

Mitigation

To protect yourself against these attacks:

Enable Workspace Trust: Settings -> Security: Workspace Trust.
Disable Automatic Tasks: Settings -> Task: Allow Automatic Tasks -> off.

1.7 KiB Executable File Raw Permalink Blame History