CVE-2025-59286
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A command injection vulnerability in Copilot allows an unauthorized attacker to disclose information over a network. It stems from improper neutralization of special elements used in commands.
Risk Assessment
An attacker could remotely access sensitive information processed by Copilot, potentially compromising the confidentiality of organizational data.
Recommendation
Update Copilot to the latest version and restrict network access to the service to trusted sources.
Other vulnerabilities in Copilot
See all- CVE-2025-59272Critical
A command injection vulnerability in Copilot allows an unauthorized attacker to perform information disclosure locally. It stems from improper neutralization of special elements used in commands.
- CVE-2025-59252Critical
A command injection vulnerability in Copilot allows an unauthorized attacker to disclose information over a network. It stems from improper neutralization of special elements used in commands.
Original NVD description (English source)
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS