Microsoft Visual Studio Code Copilot Chat Extension vulnerabilities
8 vulnerabilities
Known vulnerabilities in Microsoft Visual Studio Code Copilot Chat Extension, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-21264microsoftmicrosoft visual studio code copilot chat extension+1
EPSS score0.79%
Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2025-62449microsoftgithub_copilot_chat+1EPSS score0.47%
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally.CVE-2025-62222microsoftgithub_copilot_chat+1EPSS score0.80%
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.CVE-2026-21523microsoftmicrosoft visual studio code copilot chat extension+1EPSS score0.78%
Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.CVE-2026-21518microsoftmicrosoft visual studio code copilot chat extension+1EPSS score1.46%
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-65675microsoftgithub_copilot_chat+1EPSS score0.64%
No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-45482microsoftmicrosoft visual studio code copilot chat extension+1EPSS score0.41%
Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-23653microsoftgithub_copilot_chat+1EPSS score0.74%
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network.