High severity7.8NVD Advisory· Published Aug 12, 2025· Updated Jun 17, 2026
CVE-2025-53773
CVE-2025-53773
Description
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.
Affected products
4cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*range: >=17.14.0,<17.14.12
- (no CPE)
- Microsoft/Microsoft Visual Studio 2022 version 17.14v5Range: 17.14.0
Patches
Vulnerability mechanics
References
3- embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/nvdExploitThird Party Advisory
- msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53773nvdVendor Advisory
- news.ycombinator.com/itemnvdThird Party Advisory
News mentions
0No linked articles in our index yet.