Executive brief
GitHub Copilot is an AI-powered coding assistant that helps developers write and debug code within their development environment. A security flaw in version 1.372.0 allows the tool to access files on the user's computer that are outside of the designated project folder without asking for permission. If an attacker uses a technique called 'indirect prompt injection'—such as placing hidden instructions in a bug report or code file—they could trick the AI into stealing sensitive files or data from the developer's machine.
Technical details
A path traversal or improper input validation vulnerability exists in GitHub Copilot 1.372.0 within the 'fetch_webpage' tool. The vulnerability is triggered via a 'file-handler' URI parameter that fails to restrict access to the active workspace directory. An attacker can exploit this through indirect prompt injection, where malicious instructions embedded in external data (like a Jira ticket or a web page) are processed by the LLM. This allows the attacker to bypass workspace boundaries and access arbitrary files on the local filesystem without user approval. The issue is specifically linked to the 'fetchPageTool.ts' component in the VS Code extension.
Affected products
- GitHub Copilot 1.372.0
Timeline
- 2025-10-28: disclosed: Initial research blog published by blindCyber.
- 2026-06-22: advisory: CVE published to the NVD.