Description
Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Visual Studio Code | 1.0.0 – < 1.132.1 | 1.132.1 |
Advisories 3
- WID-SEC-2026-2761 Microsoft Developer Tools: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- MSRC-CVE-2026-70335 GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability Microsoft Security Response Center · Sep 2, 2026
- NCSC-2026-0285 Kwetsbaarheden verholpen in Microsoft Developer Tools NCSC-NL (Netherlands) · Aug 11, 2026
References
- GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability vendor-advisory patch