← All advisories

Unrated severityNVD Advisory· Published Feb 10, 2026· Updated Apr 10, 2026

GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability

CVE-2026-21523

Description

Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

Affected products

3

GitHub/Copilot CLIllm-fuzzy
Microsoft/Visual Studio Code CoPilot Chat Extensioncpe-rescue
Range: 0.27.0
Microsoft/Visual Studiocpe-rescue
Range: 1.0.0

Patches

Vulnerability mechanics

References

1

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523mitrevendor-advisorypatch

News mentions

0

No linked articles in our index yet.