Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code can enable an attacker to read and transmit sensitive information over a network. The flaw involves improper setup of default permissions or paths, allowing read access beyond the intended scope; the presence of CWE‑22 suggests path traversal or directory restriction weaknesses.

The affected component is the Microsoft Visual Studio Code CoPilot Chat Extension. No specific version information is disclosed; any installation that has not applied the fix is potentially vulnerable.

The CVSS score of 8.4 signals a high‑impact vulnerability. The EPSS score is below 1%, implying a low but non‑zero exploitation probability. The description does not confirm whether the attack requires local access or can be executed remotely; exploitation most likely involves manipulating file paths or configuration inputs processed by the extension, after which the attacker could exfiltrate data over the network. The vulnerability is not listed in the CISA KEV catalog.