Microsoft GitHub Copilot and Visual Studio Code Command Injection Vulnerability Allowing Information Disclosure

A command injection vulnerability has been identified in GitHub Copilot and Visual Studio Code. This issue allows an authorized attacker to disclose information over a network by improperly neutralizing special elements used in commands. Specifically, the vulnerability could be exploited to reveal contents of the Model Context Protocol (MCP) when using Copilot.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure, specifically the contents of the Model Context Protocol (MCP) when using Copilot.

Remediation

Users are advised to update to the latest version of the Microsoft Visual Studio Code Copilot Chat Extension. The security update can be downloaded from the Visual Studio Code website.