Executive brief
A security vulnerability exists in the GitHub Copilot plugin for JetBrains development environments, which are tools used by software engineers to write code. An attacker could exploit this flaw to run unauthorized commands or malicious software on a developer's local computer. This could lead to the theft of sensitive source code, credentials, or full control over the developer's workstation.
Technical details
A vulnerability classified as CWE-641 (Improper Restriction of Names for Files and Other Resources) exists in the GitHub Copilot Plugin for JetBrains IDEs. The flaw stems from insufficient validation of file or resource names, which can be manipulated to achieve local code execution. While the attack vector is local, it requires user interaction (UI:R), suggesting a scenario where a user might be enticed to open a malicious file or project that interacts with the plugin. Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running the IDE. The issue is addressed in versions 1.13.0-251 and later.
Affected products
- Microsoft GitHub Copilot Plugin for JetBrains IDEs 1.0.0 to 1.13.0-251
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory