CVE-2025-64660

Command injection vulnerability in GitHub Copilot and Visual Studio Code. An unauthorized attacker can disclose information over a network.

An OS command injection vulnerability in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

Improper restriction of names for files and other resources in GitHub Copilot allows an unauthorized attacker to execute code locally.

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allow an unauthorized attacker to disclose information over a network.

A vulnerability in GitHub Copilot 1.372.0 allows filesystem access outside the workspace folder without user approval via a file-handler URI parameter in fetch_webpage. This could lead to data exfiltration if combined with indirect prompt injection.

The vulnerability in GitHub Copilot and Visual Studio Code is caused by initializing a resource with an insecure default, allowing an unauthorized attacker to disclose information over a network.

A path traversal vulnerability in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

An injection vulnerability in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over the network due to improper neutralization of special elements in output used by a downstream component.

GitHub Copilot and Visual Studio Code contain improper neutralization of special elements used in a command (command injection). An authorized attacker could exploit this to disclose information over a network.

Improper validation of generative AI output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.