A flaw in the initialization of resources in GitHub Copilot and Visual Studio Code relies on an insecure default that enables an unauthorized actor to reveal sensitive data over the network. The vulnerability stems from improper handling of default configurations, which results in data leaks rather than code execution or denial of service. The primary weakness is classified as CWE-1188, indicating insecure default settings.

Microsoft: GitHub Copilot Chat integrated within Visual Studio Code is affected. No specific version range is disclosed, so all deployments that have not applied the latest update should be considered vulnerable.

The vulnerability carries a CVSS score of 6.5, placing it in the medium severity range. EPSS information is not available, and the issue is not listed in CISA KEV. The absence of exploit data suggests no known widespread attacks, yet the attack vector appears to be any actor who can reach the affected system through network channels. Given the moderate score and lack of exploit evidence, the risk is considered moderate, but remediation is recommended to prevent potential future exploitation.