CVE-2026-83953: GitHub Copilot for Jetbrains Information Disclosure Vulnerability
CVE-2026-83953 is an information disclosure vulnerability in GitHub Copilot for Jetbrains, rated Important by Microsoft, with a CVSS 3.1 base score of 5.5 (Medium). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday, delivered through 1 security update (KB1163583). It affects 1 product in 1 product family (Other).
Key facts
- CVE ID
- CVE-2026-83953
- Severity
- Medium CVSS 5.5
- Microsoft severity
- Important
- Impact
- Information Disclosure
- Exploited in the wild
- No
- Publicly disclosed
- No
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- November 2026 Patch Tuesday
- Product families
- Other
CVSS score and vector
Microsoft scores CVE-2026-83953 at 5.5 (temporal 4.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | None |
| Availability impact | None |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an authorized attacker to disclose information locally.
Frequently asked questions (Microsoft)
What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is unauthorized file system access - reading from the file system.
Affected products (1)
Other
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| GitHub Copilot Plugin for JetBrains IDEs | KB1163583 | Security Update | 1.17.0-251 | Yes |
Security updates (1)
- KB1163583 (Security Update)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |