CVE-2025-47269

CVE-2025-47269 describes a critical vulnerability in code-server versions prior to 4.99.4, where a maliciously crafted URL leveraging the proxy subpath can lead to session token exfiltration. By failing to properly validate proxy request ports, an attacker can redirect a user's browser to an arbitrary domain, including their own, thereby capturing the user's session cookie. This allows the attacker to gain full access to the code-server instance and the underlying machine as the user running code-server. The vulnerability carries a CVSS score of 8.3 (HIGH), indicating a high-impact threat with network-based attack vector and low attack complexity, requiring user interaction. Successful exploitation grants high confidentiality and integrity impact, and low availability impact. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness at this time.