CVE-2025-8217Over-scoped CodeBuild GitHub token let an attacker ship code in Amazon Q Developer 1.84.0
What broke
AWS's security bulletin AWS-2025-015, first published July 23, 2025, says AWS found "an inappropriately scoped GitHub token in their CodeBuild configuration" for the Amazon Q Developer extension for Visual Studio Code. An attacker used that token to commit code to the extension's open-source repository, and the release process picked it up automatically and shipped it as version 1.84.0. NVD describes the result as "inert, injected code designed to call the Q Developer CLI" that runs when the extension launches. AWS Security inspected the code and found it "was unsuccessful in executing due to a syntax error," which prevented changes to any services or customer environments. Neither AWS nor the GitHub advisory describes what the code would have done had it run.
The CWE is CWE-506 (embedded malicious code). NVD has not scored it; the CNA (AWS) score is CVSS 3.1 4.0, with a local attack vector and integrity impact only. It is not on CISA KEV.
Why it matters
The vulnerable identity was the build pipeline's, not a user's. A CodeBuild job held a GitHub token that could write to the repository it built, so whoever obtained that token could decide what code an official release contained. The extension is an AI coding assistant that runs inside developer editors with the developer's own file and network access, so the reach of a working payload would have been every developer who updated. The low CVSS reflects luck, not design: the control that failed was the token's scope, and nothing downstream caught the commit before release. The same release-path weakness appears in Trivy and tj-actions/changed-files.
What to do
- Remove every 1.84.0 installation, including forks and derivative copies, and update to 1.85.0. AWS publishes the 1.84.0 SHA-256 so you can find copies.
- Give CI build jobs read-only repository tokens, and keep write and release permissions in a separate, reviewed step. Apply least privilege to every service account a pipeline uses.
- Require reviewed pull requests for anything that reaches a release branch, so a token alone cannot publish code.
After you patch
- Inventory the tokens your own build systems hold, their scopes and their expiry, and rotate any long-lived token with write access. See secrets rotation.
Sources
Related identity CVEs
Related on Start with Identity
- BlogGitLab's incoming email address is a non-expiring token that commits code and runs CI as you
Aikido Security showed that the personal address GitLab issues for creating issues by email can also open merge requests that GitLab commits in your name and ca
- BlogThe developer toolchain is now the busiest identity perimeter
A worm that wipes your home directory when you revoke its stolen token, about 1,900 hijacked GitHub accounts, a publishing trust bound to a reclaimable name, an
- BlogMalicious Claude Code extension on Cursor's marketplace planted an attacker SSH key on developer machines
Cursor said on October 29 that tampered versions 2.1.312 and 2.1.313 of the Anthropic Claude Code extension were on its marketplace for about 11 hours. They tri
- CVECommvault Web Server zero-day that exposed Metallic Microsoft 365 app secrets
An authenticated webshell flaw in Commvault Web Server, used as a zero-day in Commvault's Azure environment, where the actor may have reached client secrets cus
- ReportIdentity Breach Report 2026: how attackers get in
123 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 41 with a known MFA status, and 44% of 2025-2026 cases had no login for MFA to protect.
- CVEJFrog Artifactory checks a token's signature and issuer but not its scope
Self-hosted Artifactory before 7.133.11 validated access token signatures and issuers without enforcing scope, so a low-privilege token could perform admin acti