A Time-of-Check Time-of-Use race condition has been discovered in the GitHub Copilot Chat extension for Visual Studio Code. The flaw allows an attacker who has authorized access to the local environment to execute arbitrary code over a network connection. This type of vulnerability provides a high level of privilege escalation, potentially giving the attacker full control of the affected system.

The vulnerability affects Microsoft Visual Studio Code and specifically the Copilot Chat extension installed from GitHub Copilot. All users running these components are potentially impacted until a patch is applied.

The CVSS base score of 8.0 indicates a high severity scenario. The EPSS score is below 1%, suggesting that, currently, exploitation attempts are unlikely to be widespread. However, the vulnerability is already cataloged by the Microsoft Security Response Center and was not listed in the CISA KEV catalog, meaning that there is no publicly known active exploitation. The attack vector is likely local, requiring an authorized user to trigger the race condition, after which malicious code can be executed remotely. The overall risk remains significant due to the high impact of remote code execution.