Skip to content
OpenAdvisories
High MSRC-CVE-2026-70335 1 CVE

GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability

Published Aug 11, 2026 · Updated Sep 2, 2026 · Revision 3

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could embed malicious instructions in content that the AI agent processes, such as a web page, a repository file, or a tool response. When a user runs the agent against that content, the injected instructions could cause the agent to run commands on the user's machine without prompting for confirmation. Successful exploitation could allow the attacker to execute code in the context of the signed-in user. User interaction is required and the attack is carried out locally; no authentication is required for the attacker to supply the content.

Security updates
1.132.1 — https://code.visualstudio.com/updates/v1_132

Vulnerabilities 1

  • High 7.8
    CVE-2026-70335

    GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability

    Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

    Microsoft Visual Studio Code

Revision history

  1. #3

    Affected software updated with new package information.

  2. #2

    Updated an acknowledgement. This is an informational change only.

  3. #1

    Information published.

References