CVE-2026-23653
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose…
Published Apr 14, 2026 · updated Jun 17, 2026 · microsoft github copilot chat
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 14, 2026 · NIST NVD
Detected
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network.
Jun 17, 2026 · NIST NVD
Updated
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network.
Affected
- cpe microsoft/github copilot chatversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-23653
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-23653
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network.
nvd.nist.gov