The vulnerability is an injection flaw caused by improper neutralization of special elements in output that is later used by a downstream component. This flaw allows an attacker to supply crafted data that bypasses a security enforcement mechanism in both GitHub Copilot and Visual Studio Code. The weakness is a classic input–output contamination problem identified as CWE‑74 and can lead to an unauthorized attacker overriding controls that normally restrict or filter user actions.

Microsoft Visual Studio Code is the only vendor/product listed, with no specific affected versions provided. The issue applies to instances running the default Copilot integration within the editor.

The CVSS score of 8.8 indicates high severity. No EPSS score is available, so exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, but due to its high impact score and the fact it can be triggered over a network, it warrants immediate attention. The likely attack vector is a remote attacker providing malicious output that is injected into the editor’s security checks; no privileged access or local privilege escalation is required.