The vulnerability is a command injection flaw that allows an attacker to execute arbitrary code within the environment of GitHub Copilot and Visual Studio. By supplying specially crafted input that is not properly escaped, an unauthorized user can inject system commands into the backend process, leading to execution of unintended code. The flaw corresponds to CWE-77 and CWE-94, potentially compromising confidentiality, integrity, and availability of the affected system.

Affected products include Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.3. These versions are bundled with the GitHub Copilot extension, which is also impacted. No other versions are explicitly enumerated in the advisory.

The CVSS score of 8.8 classifies the issue as high severity. The EPSS score of less than 1% indicates a low probability of exploitation but does not eliminate risk, especially for highly motivated actors. The vulnerability is not listed in CISA's KEV catalog, but the attack vector is likely network-based, leveraging untrusted input from the Copilot service to execute commands on the local host when the extension is installed.