Visual Studio Code Copilot Chat Extension CVEs and Security Vulnerabilities

CVE-2026-65675

CoPilot Chat Security Feature Bypass Vulnerability

No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Github Copilot Chat Visual Studio Code Visual Studio Code Copilot Chat Extension

CVE-2026-45482

Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code Visual Studio Code Copilot Chat Extension

CVE-2026-23653

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Github Copilot Chat Visual Studio Code Copilot Chat Extension

CVE-2026-21518

GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code Visual Studio Code Copilot Chat Extension

CVE-2026-21523

GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability

Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code Visual Studio Code Copilot Chat Extension

CVE-2025-62222

Agentic AI and Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Github Copilot Chat Visual Studio Visual Studio Code Copilot Chat Extension

CVE-2025-62449

Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Github Copilot Chat Visual Studio Visual Studio Code Copilot Chat Extension

CVE-2025-21264

Visual Studio Code Security Feature Bypass Vulnerability

Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code Visual Studio Code Copilot Chat Extension

Search vulnerabilities

CoPilot Chat Security Feature Bypass Vulnerability

Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability

Agentic AI and Visual Studio Code Remote Code Execution Vulnerability

Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability

Visual Studio Code Security Feature Bypass Vulnerability