EUVD-2026-29691Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered injection needs no authentication (PR:N) but requires the developer to open malicious content (UI:R); downstream bypass yields total impact within the unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
AnalysisAI
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a remote, unauthenticated attacker inject unneutralized special elements into a downstream component (CWE-74) to defeat a built-in protection, provided a developer is lured into a triggering action (UI:R). With CVSS 8.8 and full confidentiality/integrity/availability impact, successful exploitation could subvert Copilot/editor security controls; however there is no public exploit identified at time of analysis, EPSS is low (0.06%), and CISA SSVC records exploitation status as none.
Technical ContextAI
This is a CWE-74 injection ('improper neutralization of special elements in output used by a downstream component'). The affected technology is the AI-assisted coding stack - GitHub Copilot integrated into Microsoft editors, with the CPE and EUVD affected-version data specifically pinning Visual Studio Code (cpe:2.3:a:microsoft:visual_studio_code, versions 1.0.0 up to but not including 1.119.1). The root cause class means content that flows from the extension/assistant into a downstream consumer (e.g., another component, renderer, or command surface) is not properly sanitized, so crafted special characters/sequences are interpreted rather than treated as inert data, enabling the observed authentication/security-feature bypass tagged in the intel sources.
RemediationAI
Vendor-released patch: Visual Studio Code 1.119.1 - upgrade all affected VS Code installations to 1.119.1 or later and ensure the GitHub Copilot extension is updated to the vendor-fixed version referenced in Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109. Because exploitation requires user interaction, meaningful compensating controls until patching completes include restricting developers from opening untrusted repositories/files and enabling VS Code Workspace Trust so untrusted workspaces run in a restricted mode (trade-off: some extensions/features are disabled in untrusted folders), and temporarily disabling or limiting the Copilot extension on high-value endpoints if the fixed extension cannot yet be deployed (trade-off: loss of AI assistance). Additional context is available at https://vuldb.com/vuln/363220.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Local code execution in Microsoft Visual Studio Code stems from a command injection flaw (CWE-77) that lets an attacker
Security feature bypass via path traversal in GitHub Copilot and Visual Studio Code allows a local unauthorized attacker
Fail-open security logic in Visual Studio Code permits network-based security feature bypass by an unauthenticated attac
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today