What’s Vulnerable › Vulnerabilities

CVE-2025-61680: Minecraft RCON Terminal: Plain Text Password Storage in Configuration

• Severity: medium (CVSS 6.6 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-03 · updated 2026-10-08
• Weakness: CWE-256

Description

Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code's configuration API which writes to settings.json in plaintext. This issue is fixed in version 2.1.0.

Affected products

• jaketcooper Minecraft-rcon: from 0.1.0, < 2.1.0

References

• https://github.com/jaketcooper/Minecraft-rcon/commit/31272b541482d095d1578855c2b571268eb9b877
• https://github.com/jaketcooper/Minecraft-rcon/releases/tag/2.1.0
• https://github.com/jaketcooper/Minecraft-rcon/security/advisories/GHSA-4m33-hxqw-7j77

Get alerted when CVE-2025-61680 or the next vulnerability affects your stack