Unrated severityNVD Advisory· Published Feb 10, 2026· Updated Apr 10, 2026
GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-21523
Description
Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.
Affected products
3- Microsoft/Microsoft Visual Studio Code CoPilot Chat Extensionv5Range: 0.27.0
- Microsoft/Visual Studio Codev5Range: 1.0.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523mitrevendor-advisorypatch
News mentions
0No linked articles in our index yet.