Github Copilot vulnerabilities

3 known vulnerabilities in Github Copilot from Microsoft. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Github Copilot: Files or Directories Accessible to External Parties

  CVE-2025-66389Jun 22, 2026MicrosoftEPSS 1.18%

  GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.

• 7.8 High severity

  GitHub Copilot Plugin for JetBrains IDEs: Improper Neutralization of Special Elements used in a Command

  CVE-2026-21516Feb 10, 2026Microsoft

  Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an unauthorized attacker to execute code over a network.

• 7.8 High severity

  GitHub Copilot Plugin for JetBrains IDEs: Improper Neutralization of Special Elements used in a Command

  CVE-2025-64671Dec 9, 2025Microsoft

  Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally.