This vulnerability arises from the GitHub Copilot extension in Visual Studio Code failing to protect stored credentials. An attacker who can access the VS Code instance can read sensitive authentication tokens or other credentials that might provide additional access privileges. The weakness is identified as CWE‑200 (Information Exposure) and CWE‑522 (Insufficiently Protected Credentials).

Microsoft Visual Studio Code with the GitHub Copilot integration is affected. No specific version ranges are documented, so any release that includes Copilot may be vulnerable until an official patch is applied.

The CVSS score of 6.5 classifies the issue as medium severity, and the EPSS score of less than 1 % indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack path involves an attacker gaining network access to the VS Code environment, either locally or remotely, and intercepting or accessing the Copilot extension host to retrieve stored credentials.