CVE-2025-62449: Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability

Overview

Severity
Medium (CVSS 6.8)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C
Category
Security Feature Bypass
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2025-Nov
Released
2025-11-11
EPSS Score
0.03% (percentile: 10.2%)

Description

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally.

FAQ

What kind of security feature could be bypassed by successfully exploiting this vulnerability? An attacker who successfully exploited this vulnerability could bypass Visual Studio Code sensitive file protections. According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), and integrity (I:H), and some loss of availability (A:L). What does that mean for this vulnerability? An attacker who successfully exploited this vulnerability could view sensitive information (Confidentiality) and modify code in the repo, (Integrity), and they might be able to interfere with availability of the code (Availability).

Affected Products (1)

Developer Tools

  • Microsoft Visual Studio Code CoPilot Chat Extension

Security Updates (1)

Acknowledgments

<a href="https://twitter.com/philiptsukerman">Philip Tsukerman</a> with <a href="https://cyberark.com/">Cyberark</a>

Revision History

  • 2025-11-11: Information published.