Improper neutralization of special elements used in a command, commonly known as command injection, is present in the GitHub Copilot plugin for JetBrains IDEs. This flaw allows an unauthorized attacker to construct input that is not properly sanitized and thereby cause the plugin to execute arbitrary shell commands on the host machine. The vulnerability is categorized as CWE‑77 and results in both confidentiality and integrity violations, permitting the attacker to run any code or scripts with the privileges of the user running the IDE.

The affected product is the Microsoft GitHub Copilot Plugin for JetBrains IDEs. No specific versions are listed in the advisory, so any installation of the plugin, regardless of patch level, may be vulnerable unless a later update explicitly addresses this issue.

The CVSS score of 8.4 classifies this as a high‑severity vulnerability. EPSS indicates a very low probability of exploitation, yet the flaw remains unlisted in KEV, meaning no public exploitation has been reported. The likely attack vector is local; an attacker who can supply or influence input to the plugin—such as a malicious user or compromised extension—can trigger the command injection, leading to local code execution. Even though exploitation is not widespread, the potential impact is severe, justifying prompt remediation.