CVE-2025-59272
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A command injection vulnerability in Copilot allows an unauthorized attacker to perform information disclosure locally. It stems from improper neutralization of special elements used in commands.
Risk Assessment
An attacker with local access could obtain sensitive information from the system running Copilot, potentially leading to data leakage.
Recommendation
Update Copilot to the latest version and restrict local access to the application to trusted users only.
Other vulnerabilities in Copilot
See all- CVE-2025-59286Critical
A command injection vulnerability in Copilot allows an unauthorized attacker to disclose information over a network. It stems from improper neutralization of special elements used in commands.
- CVE-2025-59252Critical
A command injection vulnerability in Copilot allows an unauthorized attacker to disclose information over a network. It stems from improper neutralization of special elements used in commands.
Original NVD description (English source)
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosure locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS