CVE-2026-23653 — Command Injection in Microsoft Visual Studio Code Copilot Chat Extension

CWE-77 — Command Injection3 documents3 sources
Severity
5.7MEDIUMNVD
EPSS
0.1%
top 70.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft Visual Studio Code Copilot Chat Extension
Timeline
PublishedApr 14

Description

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NExploitability: 2.1 | Impact: 3.6

Affected Packages1 packages

🔴Vulnerability Details

2
CVEList
GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability↗2026-04-14
▶
GHSA
GHSA-ghqv-73vw-x3j9: Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized atta↗2026-04-14
▶
CVE-2026-23653 — Command Injection in Microsoft | cvebase