CVE-2026-21518: GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

Overview

Severity
High (CVSS 8.8)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Security Feature Bypass
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2026-Feb
Released
2026-02-10
Last Updated
2026-04-01
EPSS Score
0.04% (percentile: 12.1%)

Description

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

FAQ

What kind of security feature could be bypassed by successfully exploiting this vulnerability? The authentication feature could be bypassed as this vulnerability allows impersonation.

Affected Products (2)

Developer Tools

  • Visual Studio Code
  • Microsoft Visual Studio Code CoPilot Chat Extension

Security Updates (2)

Acknowledgments

Amol Dosanjh, Dre Cura (@dre_cura), and Nicholas Zubrisky (@NZubrisky) of TrendAI Research of Trend with https://www.zerodayinitiative.com/, <a href="https://www.linkedin.com/in/huseyintintas">H&#252;seyin TINTAŞ</a> with Kredi Kayıt B&#252;rosu, Suryakant Dhakane

Revision History

  • 2026-02-10: Information published.
  • 2026-02-27: Download links fixed
  • 2026-04-01: To comprehensively address the vulnerability, Microsoft has released a new security update for Visual Studio Code. Microsoft reccomends installing version 1.110.1 to be protected from this vulnerability.