Skip to content
OpenAdvisories
High MSRC-CVE-2025-64660 1 CVE

GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability

Published Nov 11, 2025 · Updated Nov 25, 2025 · Revision 2

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, privileges are required (PR:L) and user interaction is required (UI:R). How could an attacker exploit this remote code execution vulnerability?
An authenticated attacker could place a malicious file in the targeted repo. The user would then have to trust the file on Visual Studio Code and ask for assistance from GitHub Copilot.

Security updates
1.106.2 — https://code.visualstudio.com/updates/v1_106

Vulnerabilities 1

  • High 8.0
    CVE-2025-64660

    GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability

    Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.

    Microsoft Visual Studio Code

Revision history

  1. #2

    The following revisions have been made: 1) In the Security Updates table, corrected the impact entries to Remote Code Execution. 2) The CVSS scores have been updated. These are informational changes only. Customers who have successfully installed the update do not need to take any further action.

  2. #1

    Information published.

References