Github Copilot
Monthly
GitHub Copilot is vulnerable to command injection attacks that enable remote code execution without requiring authentication or user interaction beyond a click. An attacker can exploit this network-accessible vulnerability to execute arbitrary commands on affected systems. No patch is currently available for this high-severity vulnerability.
Command injection in the GitHub Copilot plugin for JetBrains IDEs lets a local attacker with low-level privileges execute arbitrary code on a developer's workstation; because the flaw is triggered through the plugin's local command path, it cannot be reached remotely over the network (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High). Exploitation requires the Copilot plugin to be installed in a JetBrains IDE and the attacker to already have local access to the host, where crafted input passed into the vulnerable command handling is executed without further user interaction. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is low at 0.36% (28th percentile), so this is a credible but not emergency-grade issue that primarily threatens developer endpoints rather than web-based or cloud Copilot usage.
GitHub Copilot is vulnerable to command injection attacks that enable remote code execution without requiring authentication or user interaction beyond a click. An attacker can exploit this network-accessible vulnerability to execute arbitrary commands on affected systems. No patch is currently available for this high-severity vulnerability.
Command injection in the GitHub Copilot plugin for JetBrains IDEs lets a local attacker with low-level privileges execute arbitrary code on a developer's workstation; because the flaw is triggered through the plugin's local command path, it cannot be reached remotely over the network (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High). Exploitation requires the Copilot plugin to be installed in a JetBrains IDE and the attacker to already have local access to the host, where crafted input passed into the vulnerable command handling is executed without further user interaction. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is low at 0.36% (28th percentile), so this is a credible but not emergency-grade issue that primarily threatens developer endpoints rather than web-based or cloud Copilot usage.