CVE-2025-64671
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally.
Risk Assessment
An unauthorized attacker could execute arbitrary code locally, potentially leading to system compromise.
Recommendation
Apply available security updates for Copilot to fix the vulnerability.
Other vulnerabilities in Copilot
See all- CVE-2025-59286Critical
A command injection vulnerability in Copilot allows an unauthorized attacker to disclose information over a network. It stems from improper neutralization of special elements used in commands.
- CVE-2025-59272Critical
A command injection vulnerability in Copilot allows an unauthorized attacker to perform information disclosure locally. It stems from improper neutralization of special elements used in commands.
- CVE-2025-59252Critical
A command injection vulnerability in Copilot allows an unauthorized attacker to disclose information over a network. It stems from improper neutralization of special elements used in commands.
Original NVD description (English source)
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS