This vulnerability is found in the AI Code extension for Visual Studio Code. By using a generic template, a malicious user can inject a prompt that fools the AI model into classifying harmful terminal commands as safe. When the model judges the command to be safe, it is executed automatically without user approval, giving the attacker arbitrary control over the local system. The core weakness is an input validation error (CWE-20) that allows prompt injections to escape the model’s safety checks.

The affected software is the AI Code extension developed by tianguaduizhang, available on the Visual Studio Code marketplace. The product name is "ai_code". No specific version numbers are listed in the advisory, so all installations of this extension are potentially vulnerable until a patch is released.

The calculated CVSS score of 9.6 classifies this flaw as critical, indicating a high potential for serious impact. The EPSS score is below 1 %, suggesting that, while the vulnerability is severe, it is not widely exploited at present. The flaw is not yet listed in the CISA KEV catalog. Because the exploit requires only that a user inject a crafted prompt into the extension—an action that can be performed locally or through any interface that allows input to the extension—it can be used by attackers who have a foothold in the development environment or who can lure a user into providing a malicious prompt. The lack of a public fix means that the safest approach today is to remove or disable the extension until a vendor release addresses the issue.