Executive brief
A security vulnerability exists in GitHub Copilot and Microsoft Visual Studio Code, popular tools used by developers to write and manage software code. An attacker with local access to a system could bypass built-in security protections to access or modify files they should not be able to reach. This could lead to the theft of sensitive source code, unauthorized changes to software projects, or a complete compromise of the developer's workstation.
Technical details
A path traversal vulnerability (CWE-22) exists in the integration between GitHub Copilot and Microsoft Visual Studio Code. The flaw stems from improper limitation of pathnames to restricted directories, which can be exploited by a local, unauthorized attacker. By providing specially crafted path inputs, an attacker can bypass security boundaries to read, write, or delete files outside of the intended application scope. The vulnerability has a CVSS 3.1 score of 8.4, reflecting high impact on confidentiality, integrity, and availability without requiring elevated privileges or user interaction.
Affected products
- GitHub Copilot
- Microsoft Visual Studio Code
Timeline
- 2026-06-09: disclosed: Initial disclosure by Microsoft and NVD.
- 2026-06-09: advisory: Microsoft Security Response Center published an advisory.