CVE-2025-53773
GitHub Copilot and Visual Studio Remote Code Execution Vulnerability
HIGH 7.8EPSS 3.2%
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.
- Affected
- Microsoft · Microsoft Visual Studio 2022 version 17.14
- CVSS v3.1 MICROSOFT
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 3.24% chance of exploitation in the next 30 days, 88th percentile
- Published
- 2025-08-12
- Updated
- 2026-02-26
Proof-of-concept exploits (3)
- https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt…
- persistent-security/poc-ai-copilot-rce1★ · 2025-08-13
- heatonb1/AI-Red-Teaming-Guide-Fork0★ · 2026-06-30
Security advisories
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53773
- https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt…
- https://news.ycombinator.com/item?id=44883108