Technical impact
The vulnerability is a command injection flaw in the GitHub Copilot Plugin for JetBrains IDEs. Improper neutralization of special elements allows an attacker to inject system commands, resulting in remote code execution on the host system. This flaw would enable an adversary to execute arbitrary code with the privileges of the application user.
Affected Systems
Microsoft GitHub Copilot Plugin for JetBrains IDEs is affected. No specific version information was provided in the advisory, so any installation of the plugin remains potentially vulnerable until a patch is applied.
Risk and Exploitability
The CVSS score of 8.8 categorizes this flaw as high severity. Although the exploit probability score is low (<1%), the vulnerability is not yet listed in the CISA KEV catalog, meaning a known exploit is not publicly confirmed. The likely attack vector is an unauthorized attacker exploiting the plugin over a network connection to the IDE, which requires interaction with the plugin’s command processing logic. Without a patch, the risk remains significant due to the potential for complete compromise of the host machine.
