An attacker who already has legitimate access can exploit a command injection flaw in the integration between GitHub Copilot and Visual Studio. The flaw is caused by improper neutralization of special command elements, allowing the attacker to execute arbitrary commands with elevated privileges across a network. This can lead to unauthorized system access, data exposure, or further lateral movement within the organization.

Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.3 are affected by the vulnerability. The issue arises in the environment that processes GitHub Copilot requests in these versions.

The vulnerability has a CVSS score of 8, indicating a high severity. The EPSS indicates less than 1% probability of exploitation at this time, and it is not listed in the CISA KEV catalog. The attack requires an authorized user within the development environment and likely demands authentication and the ability to invoke Copilot. Defense measures should consider the elevated privilege vector and the potential for command execution across the network.