CVE-2026-50519
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The vulnerability in GitHub Copilot and Visual Studio Code is caused by initializing a resource with an insecure default, allowing an unauthorized attacker to disclose information over a network.
Risk Assessment
The organization is at risk of confidential data leakage, which could be intercepted by an attacker without requiring system access privileges.
Recommendation
It is recommended to immediately update GitHub Copilot and Visual Studio Code to the latest version that fixes this vulnerability, and review default security configurations.
Other vulnerabilities in GitHub Copilot
See all- CVE-2026-70335High
An OS command injection vulnerability in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
- CVE-2026-50510High
Improper restriction of names for files and other resources in GitHub Copilot allows an unauthorized attacker to execute code locally.
- CVE-2026-47282Medium
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allow an unauthorized attacker to disclose information over a network.
- CVE-2025-66389High
A vulnerability in GitHub Copilot 1.372.0 allows filesystem access outside the workspace folder without user approval via a file-handler URI parameter in fetch_webpage. This could lead to data exfiltration if combined with indirect prompt injection.
- CVE-2026-45482High
A path traversal vulnerability in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- CVE-2026-41109High
An injection vulnerability in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over the network due to improper neutralization of special elements in output used by a downstream component.
Original NVD description (English source)
Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.