CVE-2025-8217 concerns the Amazon Q Developer for Visual Studio Code Extension version 1.84.0, where an inappropriately scoped GitHub token allowed a threat actor to commit malicious code into the extension's open-source repository. This code was automatically included in the 1.84.0 release. However, AWS Security analysis found the malicious code contained a syntax error that prevented execution, thus no changes to services or customer environments occurred. AWS revoked the compromised token, removed the malicious code, and released version 1.85.0. The vulnerable version 1.84.0 was removed from distribution channels to prevent further installations.

The malicious code included in version 1.84.0 did not execute due to a syntax error, so no unauthorized changes or damage to AWS services or customer environments occurred. However, the presence of malicious code in a distributed extension poses a risk if exploited in future versions or if the code is corrected by an attacker. Existing installations of 1.84.0 still contain the malicious code, though it is non-functional.

AWS has revoked the compromised GitHub token, removed the malicious code from the codebase, and released Amazon Q Developer for Visual Studio Code Extension version 1.85.0. Version 1.84.0 has been removed from distribution channels. Customers should immediately remove or update any installations of version 1.84.0, including forked or derivative copies, to version 1.85.0. No further action is required as the malicious code cannot execute in the affected version.