What is the CVSS score of CVE-2026-50510?

CVE-2026-50510 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of GitHub Copilot are affected by CVE-2026-50510?

A vulnerability in the GitHub Copilot plugin for JetBrains IDEs (CVE-2026-50510) could allow attackers to execute code on developer machines, potentially exposing source code, credentials, and…. A patch is available.

How to fix or mitigate CVE-2026-50510?

Within 24 hours, inventory all JetBrains IDE installations with the GitHub Copilot plugin enabled and notify affected developers of the vulnerability. Within 7 days, apply the vendor patch (Microsoft MSRC CVE-2026-50510) to all affected Copilot plugin installations; verify patch application by confirming the updated plugin version. Within 30 days, conduct a security audit of affected developer machines for signs of exploitation, review recent code commits for unauthorized modifications, and ensure endpoint detection tools are monitoring for related attack indicators.

GitHub Copilot CVE-2026-50510

EUVD-2026-44116 HIGH

Improper Restriction of Names for Files and Other Resources (CWE-641)

2026-07-14 microsoft

GHSA-hjgg-v5cf-x59v

Authentication Bypass Github Copilot Plugin For Jetbrains Ides

7.8

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local code execution in an IDE plugin needs no privileges but requires the developer to open/trigger malicious content, so AV:L, PR:N, UI:R with full CIA impact in the user's session.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:50 vuln.today

CVE Published

Jul 14, 2026 - 17:08 nvd

HIGH 7.8

DescriptionNVD

Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in the GitHub Copilot plugin for JetBrains IDEs allows an unauthorized attacker to run arbitrary code on a developer's machine by leveraging improper restriction of file/resource names (CWE-641), with exploitation requiring the victim to perform an action (UI:R). Rated CVSS 7.8 (high) with full confidentiality, integrity, and availability impact, this is a local-vector flaw affecting developers running the Copilot extension; no public exploit identified at time of analysis and it is not listed in CISA KEV. Microsoft has published a fix advisory (MSRC CVE-2026-50510).

Technical ContextAI

The vulnerability lies in the GitHub Copilot plugin for JetBrains IDEs (CPE: cpe:2.3:a:microsoft:github_copilot_plugin_for_jetbrains_ides), an AI pair-programming extension that integrates into IntelliJ-family IDEs and processes AI-generated suggestions, file references, and resource names within the developer's workspace. The root cause is CWE-641 (Improper Restriction of Names for Files and Other Resources): the plugin fails to properly sanitize or restrict names used to reference files or resources, which can be abused to point at or create resources outside the intended scope (e.g., path traversal or resolution to attacker-influenced files/executables). Because IDE plugins run with the developer's own privileges and can trigger file operations or tool invocation, a mishandled resource name can be steered into executing code on the local host.

RemediationAI

Patch available per vendor advisory: update the GitHub Copilot plugin for JetBrains IDEs to the fixed version published by Microsoft, following https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50510 (the exact fixed build is not stated in the available data - confirm it in the MSRC advisory and via the JetBrains Marketplace). Apply the update through the IDE's plugin manager and restart the IDE to ensure the vulnerable code path is replaced. As interim compensating controls where immediate patching is not possible, disable or uninstall the Copilot plugin (trade-off: loss of AI completion functionality), and instruct developers not to open untrusted or unfamiliar projects/files with Copilot active (trade-off: relies on user discipline and does not fully close the flaw); enabling JetBrains 'Safe Mode'/trusted-project prompts reduces automatic processing of untrusted workspaces at the cost of extra confirmation friction.