MediumCVSS 6.5
No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.
Product
Microsoft visual studio code copilot chat extension vulnerabilities
8 published CVES affecting Microsoft visual studio code copilot chat extension, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 8
- Critical
- 0
- High
- 5
- Medium
- 3
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest Microsoft visual studio code copilot chat extension CVEs
Newest publication first
-
-
CVE-2026-45482 Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability
PublishedHighCVSS 8.4Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
MediumCVSS 6.5
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network.
-
HighCVSS 8.0
Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.
-
CVE-2026-21518 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
PublishedHighCVSS 8.8Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
-
MediumCVSS 6.8
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally.
-
HighCVSS 8.8
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.
-
HighCVSS 7.1
Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.