GitHub Copilot CVE-2025-64671

Exploitation requires the GitHub Copilot plugin for JetBrains IDEs to be installed and the attacker to have local access to the host with at least low-level privileges (PR:L) to deliver crafted input into the vulnerable command path; CVSS AV:L means it cannot be triggered remotely over a network. No end-user interaction is required once the malicious input is processed (UI:N). Limiting factors: the attacker must already be local/authenticated on the developer machine, and only environments running the specific JetBrains Copilot plugin are affected, so default remote and web-based Copilot usage is out of scope.

This is a credible but not emergency-grade issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a locally-exploitable command injection requiring low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact on the affected host. The exploitation signals temper this: EPSS is only 0.36% (28th percentile), the CVE is NOT listed in CISA KEV, and no public exploit code was identified in the provided intelligence, so there is no public exploit identified at time of analysis. The low EPSS is consistent with a local-only vector - local attack surface inherently limits mass, remote, automatable exploitation, which is why a 7.8 HIGH here is a meaningfully lower real-world priority than a comparable network-vector flaw. No SSVC decision data was provided in the input. Key caveat: the description is terse ('execute code locally') and the only reference is the Microsoft MSRC advisory, so the precise injection sink and preconditions are not independently confirmed. No conflict exists between the CVSS vector (local) and the description (local) - both agree this is a local-access issue, not remote.

A local attacker who already has a foothold on a developer workstation (e.g., a low-privileged local account or a malicious project opened in the IDE) supplies crafted input that the GitHub Copilot JetBrains plugin passes unsanitized into a command, causing arbitrary code execution in the context of the IDE user. No user interaction is required once the malicious input is processed (UI:N). No public proof-of-concept was identified in the provided data.