Microsoft GitHub Copilot and Visual Studio Code Time-of-Check Time-of-Use Race Condition Remote Code Execution Vulnerability

A time-of-check time-of-use (TOCTOU) race condition has been identified in GitHub Copilot and Visual Studio Code. This vulnerability allows an authorized attacker to execute code remotely. The issue arises from prompt injection, where the system is manipulated into carrying out instructions controlled by the attacker. This can lead to remote code execution by causing backend components or integrated tools to execute unintended commands.

Impact

Exploitation of this vulnerability could result in unauthorized remote code execution on the affected system.

Remediation

Users can download the security update for Visual Studio Code from the Visual Studio Code website. For GitHub Copilot, no specific update instructions are provided, but users should ensure they are using the latest version.