CVE-2025-62222

HighCVSS 8.8

Published: 11/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.80%

56th percentile - higher than 56% of all known CVEs

Summary

Improper neutralization of special elements used in a command (command injection) in the Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.

Risk Assessment

A remote attacker could exploit the flaw to execute code in the extension context, potentially compromising the development environment.

Recommendation

Update the Visual Studio Code CoPilot Chat Extension to the latest patched version.

Other vulnerabilities in Visual Studio Code CoPilot Chat Extension

CVE-2025-62449Medium
The Visual Studio Code CoPilot Chat Extension contains a path traversal vulnerability due to improper limitation of a pathname to a restricted directory. An authorized attacker can locally bypass a security feature.

Original NVD description (English source)

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS