Skip to content
OpenAdvisories
High MSRC-CVE-2026-65675 1 CVE

CoPilot Chat Security Feature Bypass Vulnerability

Published Aug 11, 2026 · Updated Sep 24, 2026 · Revision 4

Vendor: Microsoft

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by supplying specially crafted content that the AI coding agent processes, causing it to write files outside the workspace folder the user opened. Exploitation requires the user to be operating the agent in an automatic edit-approval mode. Successful exploitation could allow an attacker to create or modify files that the user did not intend the agent to change.

Security updates
1.132.1 — https://code.visualstudio.com/updates/v1_132

Vulnerabilities 1

Revision history

  1. #4

    Updated the fixed version information and download link. The fix was previously believed to be included in Dynamics 365 Server (on-premises) version 6.2; however, it has been confirmed that the fix is included in Dynamics 365 Server v9.1 (on-premises) Update 1.45 (version 9.1.0045.0011). The download link, release notes, and build number has been updated accordingly in the Security Updates table. This is an informational change only.

  2. #3

    Affected software updated with new package information.

  3. #2

    CWE added. Informational change only.

  4. #1

    Information published.

References