From Dev.to
I audited 100 third-party VS Code extensions. 19 ship known-CVE deps
Live Server — 84 million installs, the top row of the results below — bundles websocket-driver 0.7.4 and gets caught by CRITICAL GHSA-xv26-6w52-cph6 / CVE-2026-54466. It is the loudest finding in a sc...