Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to have a deep understanding of the system. Successful exploitation is not guaranteed and depends on a combination of factors that might include the environment, system configuration, and the presence of additional security measures. What type of information could be disclosed by this vulnerability? Successful exploitation could allow an attacker to obtain sensitive information from the user's development environment, including workspace data and environment variables, by causing GitHub Copilot agent mode to send that information to an attacker-controlled service.
<a href="https://www.linkedin.com/in/gustavo-gilli-uhlein/">Gustavo Uhlein</a>