Executive brief
A security vulnerability exists in GitHub Copilot Chat and Visual Studio Code due to insecure default settings. This flaw could allow an unauthorized person to access sensitive information over a network if a user interacts with a malicious link or resource. This could lead to the exposure of private development data or internal configuration details.
Technical details
This vulnerability is classified as CWE-1188 (Insecure Default Initialization of Resource) within GitHub Copilot Chat and Visual Studio Code. An unauthenticated attacker can exploit this over the network, though it requires user interaction (UI:R) to succeed. The root cause is an insecure default configuration that fails to properly restrict resource access, potentially leading to the disclosure of sensitive information (Confidentiality: High). Microsoft has addressed this in GitHub Copilot Chat versions 1.123.2 and later.
Affected products
- Microsoft GitHub Copilot Chat >= 1.0.0, < 1.123.2
- Microsoft Visual Studio Code
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory