Github Copilot CVEs and Security Vulnerabilities

CVE-2026-65675

CoPilot Chat Security Feature Bypass Vulnerability

No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Github Copilot Chat Visual Studio Code Visual Studio Code Copilot Chat Extension

CVE-2026-50519

Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability

Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Gihub Copilot Chat Github Copilot Chat Visual Studio Code

CVE-2026-50510

GitHub Copilot Remote Code Execution Vulnerability

Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Gihub Copilot Plugin For Jetbrains Ides Github Copilot

CVE-2025-66389

GitHub Copilot 1.372.0 Filesystem Access Outside Workspace via File-Handler URI

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Copilot Github Copilot

CVE-2026-23653

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Github Copilot Chat Visual Studio Code Copilot Chat Extension

CVE-2025-64671

GitHub Copilot for Jetbrains Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Gihub Copilot Plugin For Jetbrains Ides Github Copilot

CVE-2026-21516

GitHub Copilot for Jetbrains Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Gihub Copilot Plugin For Jetbrains Ides Github Copilot

CVE-2025-62222

Agentic AI and Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Github Copilot Chat Visual Studio Visual Studio Code Copilot Chat Extension

CVE-2025-62449

Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Github Copilot Chat Visual Studio Visual Studio Code Copilot Chat Extension

Search vulnerabilities

CoPilot Chat Security Feature Bypass Vulnerability

Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability

GitHub Copilot Remote Code Execution Vulnerability

GitHub Copilot 1.372.0 Filesystem Access Outside Workspace via File-Handler URI

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

GitHub Copilot for Jetbrains Remote Code Execution Vulnerability

GitHub Copilot for Jetbrains Remote Code Execution Vulnerability

Agentic AI and Visual Studio Code Remote Code Execution Vulnerability

Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability