Executive brief
Microsoft Visual Studio Code and GitHub Copilot are widely used development tools for writing and managing software code. A security flaw in these tools could allow an unauthorized attacker to access sensitive credentials, such as login tokens or passwords, over a network. If exploited, this could lead to the theft of developer identities or unauthorized access to private code repositories and corporate data.
Technical details
An information disclosure vulnerability exists in Microsoft Visual Studio Code and GitHub Copilot due to insufficiently protected credentials. The flaw, classified under CWE-522 and CWE-200, allows a remote, unauthenticated attacker to intercept or extract sensitive information over the network. Exploitation requires user interaction, typically involving a user performing a specific action within the IDE that triggers the credential exposure. Microsoft has addressed this in Visual Studio Code versions 1.128.1 and later. The attack vector is network-based with low complexity, though it relies on a user being lured into a specific interaction.
Affected products
- Microsoft Visual Studio Code 1.0.0 to 1.128.0
- GitHub GitHub Copilot
Timeline
- 2026-07-14: advisory: Initial publication by Microsoft and NVD
- 2026-07-14: patched: Fix released in Visual Studio Code 1.128.1