{
 "id": "AIR-2026-0074",
 "slug": "cve-2026-70335-os-command-injection-vulnerability-in-github",
 "title": "CVE-2026-70335: OS command injection vulnerability in GitHub Copilot and Visual Studio Code",
 "summary": "An OS command injection vulnerability in GitHub Copilot and Visual Studio Code enables unauthorized local attackers to elevate privileges. The issue stems from improper neutralization of special elements used in OS commands.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "Microsoft",
  "framework_or_tooling"
 ],
 "products": [
  "GitHub Copilot",
  "Visual Studio Code"
 ],
 "incident_date": "2026-08-11",
 "incident_date_precision": "day",
 "first_reported": "2026-08-11",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70335",
   "publisher": "NVD",
   "title": "CVE-2026-70335: Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio…",
   "published_at": "2026-08-11"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-70335",
  "github-copilot",
  "command-injection"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}