Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

GitHub Copilot and Visual Studio Code: Unauthorized Network Access

CVE-2026-21518 · published 8 months ago
Summary

GitHub Copilot and Visual Studio Code have a security issue that allows an attacker to bypass a security feature over the internet. This means an attacker could potentially access parts of the system they shouldn't be able to. Users should update to the latest versions to fix this issue.

What to do
  • Update microsoft visual_studio_code to version 1.109.2 or later.
  • Update microsoft microsoft visual studio code copilot chat extension to version 0.37.1 or later.
  • Update microsoft visual studio code to version 1.110.1 or later.
Affected software
VendorProductAffected versions
microsoft visual_studio_code < 1.109.2
cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:-:*:*
microsoft microsoft visual studio code copilot chat extension < 0.37.1
microsoft visual studio code < 1.110.1
Original advisory text
GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
1% chance of attack within 30 days
Type
CWE-77Command Injection
Timeline
Published10 Feb 2026
Updated31 Oct 2026
First seen6 Mar 2026
Sources
CVE-2026-21518 · NVD
CVE-2026-21518 · MITRE
Track software like this
Free during beta