Vulnerability in Jaketcooper Minecraft-Rcon

CVE-2025-61680

Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code's configuration API which writes to settings.json in plaintext. This issue is fixed in version 2.1.0.

EPSS: 0.003 (25.3th percentile) — read the EPSS interpretation.

Affected products

Jaketcooper Minecraft-rcon — versions >= 0.1.0, < 2.1.0

Weakness classification (CWE)

CWE-256 — Plaintext Storage of a Password

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)