CVE-2025-61680mediumCWE-256

CVE-2025-61680: medium-severity vulnerability in jaketcooper Minecraft-rcon

Minecraft RCON Terminal: Plain Text Password Storage in Configuration

Published 03 Oct 2025 · Updated 06 Oct 2025

Follow this CVE + Monitor Minecraft-rcon

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.6epss 0.4%

Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code's configuration API which writes to settings.json in plaintext. This issue is fixed in version 2.1.0.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Affected products

jaketcooper · Minecraft-rcon

References

https://github.com/jaketcooper/Minecraft-rcon/commit/31272b541482d095d1578855c2b571268eb9b877 https://github.com/jaketcooper/Minecraft-rcon/releases/tag/2.1.0 https://github.com/jaketcooper/Minecraft-rcon/security/advisories/GHSA-4m33-hxqw-7j77