Description
Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
Published: 2026-08-11
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from improper neutralization of special elements used in an operating‑system command within GitHub Copilot and Visual Studio Code. This oversight, classified as OS command injection (CWE‑78), enables an attacker with a local unauthenticated session to execute arbitrary system commands, thereby escalating privileges on the affected machine.

Affected Systems

Microsoft Visual Studio Code, including the GitHub Copilot extension. The exact product versions are not specified in the data, so the issue likely applies to all installed versions of VS Code that currently integrate the Copilot feature.

Risk and Exploitability

The CVSS score of 7.8 marks it as a high‑severity vulnerability, yet the EPSS score is reported as < 1%, indicating that exploitation is expected to be rare. Because the flaw can be exercised only after the attacker has obtained local access, the attack vector remains local, and the vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on August 12, 2026 at 19:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Visual Studio Code update that contains the fix for CVE‑2026‑70335.
  • If an immediate update is unavailable, disable or uninstall the GitHub Copilot extension to remove the susceptible code paths.
  • Employ the principle of least privilege by restricting local user accounts from running applications with elevated rights and monitor for unusual command executions.

Generated by OpenCVE AI on August 12, 2026 at 19:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Description Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
Title GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability
First Time appeared Microsoft
Microsoft visual Studio Code
Weaknesses CWE-78
CPEs cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft visual Studio Code
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Visual Studio Code
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-08-31T20:06:15.186Z

Reserved: 2026-08-04T00:04:56.036Z

Link: CVE-2026-70335

cve-icon Vulnrichment

Updated: 2026-08-11T18:27:19.791Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-11T17:19:11.153

Modified: 2026-08-28T20:19:41.990

Link: CVE-2026-70335

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-12T19:45:08Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')