This vulnerability is a command injection flaw caused by improper neutralization of special elements used in a command within Microsoft Copilot Web. An attacker can exploit this flaw to execute arbitrary commands and disclose information over a network, leading to a breach of confidentiality. The weakness aligns with CWE‑77, indicating a classic command injection issue.

Microsoft Copilot Web is the affected product. No specific version numbers are listed in the data, so all deployments of Copilot Web that have not yet applied a vendor‑supplied fix could be vulnerable.

The CVSS score of 8.8 classifies this flaw as high severity. No EPSS score is available, and it is not listed in CISA’s KEV catalog, so the current exploitation likelihood is uncertain, but the potential impact remains significant. The probable attack vector is a network‑based attacker sending crafted input to the Copilot Web interface, enabling unauthorized information disclosure. The vulnerability could be exploited by users or third parties who gain access to the Copilot service. The lack of an EPSS score suggests that the exploitation rate is not yet known, but the high severity warrants prompt attention.