Github Copilot Chat
Monthly
Information disclosure in GitHub Copilot Chat for Visual Studio Code (versions 1.0.0 up to but not including 1.123.2) lets a remote, unauthenticated attacker read sensitive data over a network because an insecure default configuration exposes a resource that should be protected. The CVSS 3.1 score of 7.5 reflects high confidentiality impact with no integrity or availability effect. There is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.53% (40th percentile).
Security feature bypass in Microsoft Visual Studio Code Copilot Chat Extension (versions 0.27.0 through pre-1.132.1) enables network-based attackers to circumvent a protective control without authentication, resulting in high integrity impact and low availability impact. The attack requires user interaction - consistent with a scenario where a victim must engage with crafted content delivered over the network. No public exploit code has been identified at time of analysis, and a vendor patch (1.132.1) is available via the Microsoft Security Response Center.
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information disclosure in GitHub Copilot Chat for Visual Studio Code (versions 1.0.0 up to but not including 1.123.2) lets a remote, unauthenticated attacker read sensitive data over a network because an insecure default configuration exposes a resource that should be protected. The CVSS 3.1 score of 7.5 reflects high confidentiality impact with no integrity or availability effect. There is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.53% (40th percentile).
Security feature bypass in Microsoft Visual Studio Code Copilot Chat Extension (versions 0.27.0 through pre-1.132.1) enables network-based attackers to circumvent a protective control without authentication, resulting in high integrity impact and low availability impact. The attack requires user interaction - consistent with a scenario where a victim must engage with crafted content delivered over the network. No public exploit code has been identified at time of analysis, and a vendor patch (1.132.1) is available via the Microsoft Security Response Center.
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.