GitHub Copilot CVE-2026-45482

Exploitation requires local-vector delivery on a machine running an affected build of Visual Studio Code with the GitHub Copilot extension installed, meaning the attacker needs a way to place attacker-controlled input - such as a malicious workspace, repository, project file, or extension-channel message - in front of the vulnerable path-handling routine. CVSS PR:N and UI:N indicate no prior privileges and no explicit user interaction are required once that input is processed, but the AV:L vector means the attacker cannot reach the flaw purely over the network and must rely on the developer opening or loading the malicious content. Limiting factors include the need for the GitHub Copilot extension to be present and enabled, the user opening untrusted project content (which Workspace Trust may gate), and the specific security feature whose bypass is in scope not being independently documented in the supplied data.

The CVSS vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a locally exploitable flaw with no privileges and no user interaction needed once code can run on the host, yielding a high 8.4 score driven by full CIA impact rather than network reach. The AV:L vector materially limits real-world risk because an attacker must already have a foothold - for example a malicious workspace, repository, or extension payload that Copilot/VS Code processes - so this is more relevant to supply-chain and developer-trust threat models than to mass internet exploitation. No EPSS score, KEV listing, or POC was provided, and no public exploit is identified at time of analysis, suggesting this is currently a patch-and-monitor priority rather than an emergency. Key gap: the only reference is the MSRC advisory stub, so independently confirmed fixed builds, affected version ranges, and the precise security feature being bypassed are not visible in the supplied data and should be validated directly with Microsoft.

A developer is socially engineered or directed to open a malicious repository, workspace folder, or shared Live Share session crafted to feed traversal sequences into a Copilot or VS Code path-handling routine. When the editor or Copilot resolves the attacker-controlled reference it escapes the intended sandbox and reads, overwrites, or executes content outside the workspace, granting access to secrets, SSH keys, or configuration files on the developer's host. No public exploit identified at time of analysis, but the low attack complexity and lack of required interaction make POC development straightforward once the affected code path is disclosed.