Potential Security Concern: CVE-2025-55182 and CodeGPT Extension #459
Description
Our IT department informed me that a security scanner flagged my computer as potentially vulnerable to CVE-2025-55182.
I do not run any web services on my system.
However, when checking open ports, I noticed that port 54112 is opened whenever VS Code is running.
This port is bound to 0.0.0.0 by the CodeGPT extension.
Inspecting the HTTP source served on this port revealed references to the Next.js framework.
Further investigation of the package.json in the CodeGPT extension’s node_modules folder shows that it uses Next.js version 15.5.3.
My concern:
Next.js 15.5.3 is listed among versions potentially affected by CVE-2025-55182. Could you please confirm whether your extension uses React Server Components or any functionality that would make it vulnerable to this CVE?