Improper restriction of names for files and other resources in the GitHub Copilot Plugin for JetBrains IDEs allows an attacker that can influence which resource names the plugin processes to execute arbitrary code on the local machine. The flaw effectively treats user‑controlled names as executable paths, granting the attacker ability to launch binaries with the privileges of the JetBrains IDE session. This results in a local code‑execution risk as described by CWE‑641, because the plugin fails to properly validate or sanitize resource identifiers before use.

The vulnerability affects the Microsoft GitHub Copilot Plugin for JetBrains IDEs. All installations of the plugin are potentially susceptible until an update is applied. No specific version range is listed in the advisory, so any current installation should be assumed vulnerable.

The CVSS score of 7.8 places the flaw in the High severity range. The EPSS score is reported as less than 1%, indicating a very low probability of exploitation at the time of this analysis, and the vulnerability is not cataloged in the CISA KEV list. Based on the description, it is inferred that the attack vector requires local access to the JetBrains IDE where the plugin is installed; thus an attacker must already have a foothold on the machine or be able to coerce the user into triggering the plugin with crafted names. No network‑based exploitation is described, so the risk is confined to environments where the plugin is installed and used.