EUVD-2026-29691Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft repo/file with unneutralized special elements
-
DeliveryLure developer to open it in VS Code/Copilot
-
ExploitInjection reaches downstream component
-
ExecutionSecurity feature bypassed
-
ImpactFull compromise of editor context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Exploitation requires a developer running a vulnerable Visual Studio Code build (1.0.0 through <1.119.1) with GitHub Copilot to be induced into a triggering interaction (UI:R) - such as opening an attacker-controlled repository, file, or Copilot-processed input containing crafted special elements. No authentication is needed (PR:N) and the vector is network-delivered (AV:N) with low complexity (AC:L), but the mandatory user-interaction step and dependence on the victim using the affected editor/extension are the primary limiting factors; scope is unchanged (S:U), so impact is confined to the victim's own VS Code/Copilot context. Note the description also names Visual Studio, but affected-version evidence only confirms VS Code. |
| Impact | Signals are mixed and should be weighed together rather than trusting the raw 8.8. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates a network-reachable, low-complexity, unauthenticated attack that still requires user interaction, and SSVC rates Technical Impact as 'total' (consistent with C:H/I:H/A:H). Countering that, EPSS is very low at 0.06% (19th percentile), SSVC marks Exploitation as 'none' and Automatable as 'no', and there is no KEV listing and no public exploit identified at time of analysis. Net assessment: a genuinely high-impact bug if triggered, but current real-world exploitation likelihood is low and non-automatable - this is a patch-in-normal-cycle priority for developer endpoints rather than an emergency, absent new exploit activity. Note a scope caveat: the description names both GitHub Copilot and Visual Studio, yet the CPE/affected-version data only enumerate Visual Studio Code - confirm the exact affected surface with Microsoft's advisory. |
| Exploit ScenarioDerived | An attacker crafts a malicious repository, file, or Copilot-consumed input containing special elements that are not neutralized before reaching a downstream component. When a developer opens or interacts with the attacker-supplied content in a vulnerable VS Code/Copilot build (UI:R), the injected sequence is interpreted downstream and bypasses the intended security feature, potentially yielding total impact on the developer's environment. No public exploit is identified at time of analysis, so this remains a plausible but currently theoretical chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a remote, unauthenticated attacker inject unneutralized special elements into a downstream component (CWE-74) to defeat a built-in protection, provided a developer is lured into a triggering action (UI:R). With CVSS 8.8 and full confidentiality/integrity/availability impact, successful exploitation could subvert Copilot/editor security controls; however there is no public exploit identified at time of analysis, EPSS is low (0.06%), and CISA SSVC records exploitation status as none.
RemediationAI
Vendor-released patch: Visual Studio Code 1.119.1 - upgrade all affected VS Code installations to 1.119.1 or later and ensure the GitHub Copilot extension is updated to the vendor-fixed version referenced in Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109. Because exploitation requires user interaction, meaningful compensating controls until patching completes include restricting developers from opening untrusted repositories/files and enabling VS Code Workspace Trust so untrusted workspaces run in a restricted mode (trade-off: some extensions/features are disabled in untrusted folders), and temporarily disabling or limiting the Copilot extension on high-value endpoints if the fixed extension cannot yet be deployed (trade-off: loss of AI assistance). Additional context is available at https://vuldb.com/vuln/363220.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-74 injection ('improper neutralization of special elements in output used by a downstream component'). The affected technology is the AI-assisted coding stack - GitHub Copilot integrated into Microsoft editors, with the CPE and EUVD affected-version data specifically pinning Visual Studio Code (cpe:2.3:a:microsoft:visual_studio_code, versions 1.0.0 up to but not including 1.119.1). The root cause class means content that flows from the extension/assistant into a downstream consumer (e.g., another component, renderer, or command surface) is not properly sanitized, so crafted special characters/sequences are interpreted rather than treated as inert data, enabling the observed authentication/security-feature bypass tagged in the intel sources.
Know when Visual Studio Code gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered injection needs no authentication (PR:N) but requires the developer to open malicious content (UI:R); downstream bypass yields total impact within the unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
Executive ViewAI
A critical security-bypass vulnerability in GitHub Copilot and Visual Studio Code (versions before 1.119.1) could allow attackers to circumvent built-in developer security protections through social engineering. This directly threatens the integrity of code developed in affected environments and represents a potential supply chain risk if compromised code reaches production. All development teams using these tools require immediate patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Security-feature bypass in Microsoft Visual Studio Code before 1.136.2 lets a remote, unauthenticated attacker defeat a
Remote code execution in Visual Studio Code (versions 1.0.0 up to but not including 1.141.1) is achievable through a pat
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check
Command injection in Visual Studio Code 1.0.0 through 1.141.0 allows an unauthenticated remote attacker to execute arbit
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
Remote code execution in Visual Studio Code versions 1.0.0 through 1.141.1 allows an unauthenticated, network-positioned
Authorization bypass in Visual Studio Code versions 1.0.0 through 1.136.1 allows an unauthenticated network attacker to
GitHub PoC
Exploit-DB