The vulnerability is a command injection flaw that permits an unauthorized attacker to disclose information over a network. While the CVE description does not explicitly confirm arbitrary command execution, it is inferred that the injection could potentially allow execution of arbitrary commands, necessitating caution. This weakness falls under CWE-77.

The affected product is Microsoft 365 Copilot from Microsoft. No specific version ranges are listed in the available data, so all instances of this product are potentially vulnerable until an official fix is released.

The CVSS score of 6.5 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker with unauthorized access to the Copilot interface exploiting the command injection point to exfiltrate data. Proper exploitation would require the attacker to interact with the feature that processes user input without adequate neutralization.