Skip to content
OpenAdvisories
High NCSC-2025-0362 4 CVEs

Kwetsbaarheden verholpen in Microsoft Visual Studio

Published Nov 11, 2025 · Updated Nov 11, 2025 · nl

Vendor: Microsoft Product: Visual Studio 2022 version 17.14 Product: Visual Studio Code Product: Visual Studio Code CoPilot Chat Extension

Summary

Microsoft heeft kwetsbaarheden verholpen in Visual Studio en Code Copilot voor Visual Studio.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om beveiligingsmaatregelen te omzeilen en willekeurige code uit te voeren in de context van het slachtoffer.

Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden malafide code te importeren.

```
Visual Studio Code CoPilot Chat Extension:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-62222 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2025-62449 | 6.80 | Omzeilen van beveiligingsmaatregel |
|----------------|------|-------------------------------------|

GitHub Copilot and Visual Studio Code:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-62453 | 5.00 | Omzeilen van beveiligingsmaatregel |
|----------------|------|-------------------------------------|

Visual Studio:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-62214 | 6.70 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
```

Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:

https://portal.msrc.microsoft.com/en-us/security-guidance

Vulnerabilities 4

  • High 8.8
    CVE-2025-62222 Public exploit

    Agentic AI and Visual Studio Code Remote Code Execution Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.

    Microsoft Microsoft Visual Studio Code CoPilot Chat Extension
  • Medium 6.8
    CVE-2025-62449

    Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally.

    Microsoft Microsoft Visual Studio Code CoPilot Chat Extension
  • Medium 6.7
    CVE-2025-62214

    Visual Studio Remote Code Execution Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally.

    Microsoft Microsoft Visual Studio 2022 version 17.14
  • Medium 5.0
    CVE-2025-62453

    GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

    Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.

    Microsoft Visual Studio Code

Revision history

  1. #1.0.0

    Initiele versie