Executive brief
GitHub Copilot and Visual Studio Code contain a command injection vulnerability that allows an attacker to inject malicious commands through improperly sanitized input. An attacker exploiting this flaw could execute arbitrary commands or disclose sensitive information from a developer's system over the network.
Technical details
The vulnerability is a command injection flaw (CWE-77/78) in GitHub Copilot and Visual Studio Code resulting from improper neutralization of special elements used in system commands. The attack vector is network-based, allowing an unauthenticated attacker to craft malicious input that bypasses input validation. By injecting shell metacharacters or command sequences, an attacker can achieve information disclosure or potentially achieve remote code execution depending on the execution context and privileges of the affected process.
Affected products
- GitHub Copilot
- Microsoft Visual Studio Code
Timeline
- 2026-09-08: disclosed