GitHub Copilot

Patch now: confirmed exploitation or KEV · 0

Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.

No record for GitHub Copilot has confirmed exploitation or a KEV flag.

Disclosed CVEs, no confirmed exploitation · 20

1. 2026-09-08
   CVE-2026-81381

   GitHub Copilot and Visual Studio Code vulnerable to credential disclosure

   2 Disclosedcredential-disclosure · github-copilot

   record AIR-2026-1350NVD ↗
2. 2026-09-08
   CVE-2026-81380

   CVE-2026-81380: GitHub Copilot and VS Code command injection vulnerability

   2 Disclosedgithub-copilot · command-injection

   record AIR-2026-0103NVD ↗
3. 2026-08-11
   CVE-2026-70335

   CVE-2026-70335: OS command injection vulnerability in GitHub Copilot and Visual Studio Code

   2 Disclosedgithub-copilot · command-injection

   record AIR-2026-0074NVD ↗
4. 2026-07-14
   CVE-2026-50510

   CVE-2026-50510: Code execution vulnerability in GitHub Copilot

   2 Disclosedcode-execution

   record AIR-2026-1181NVD ↗
5. 2026-07-14
   CVE-2026-47282

   CVE-2026-47282: Credential disclosure vulnerability in GitHub Copilot

   2 Disclosedcredential-disclosure

   record AIR-2026-1180NVD ↗
6. 2026-06-22
   CVE-2025-66389

   GitHub Copilot Vulnerability Allows Filesystem Access via URI Parameter

   2 Disclosedgithub-copilot · infra-vuln

   record AIR-2026-0024NVD ↗
7. 2026-06-19
   CVE-2026-50519

   CVE-2026-50519: Insecure resource default in GitHub Copilot and VS Code allows info disclosure

   2 Disclosedinfra_vuln

   record AIR-2026-1116NVD ↗
8. 2026-06-09
   CVE-2026-45482

   CVE-2026-45482: Path Traversal Vulnerability in GitHub Copilot and VS Code

   2 Disclosedpath_traversal

   record AIR-2026-1104NVD ↗
9. 2026-05-13
   CVE-2026-45033

   CVE-2026-45033: GitHub Copilot CLI Arbitrary Code Execution

   2 Disclosedarbitrary-code-execution · github-copilot

   record AIR-2026-1072NVD ↗
10. 2026-05-12
    CVE-2026-41109

    CVE-2026-41109: Improper Neutralization in GitHub Copilot

    2 Disclosedinjection · github-copilot

    record AIR-2026-1071NVD ↗
11. 2026-04-14
    CVE-2026-23653

    CVE-2026-23653: Command Injection Flaw in GitHub Copilot and VS Code

    2 Disclosedgithub-copilot · command-injection

    record AIR-2026-1027NVD ↗
12. 2026-03-06
    CVE-2026-29783

    GitHub Copilot CLI shell tool arbitrary code execution vulnerability

    2 Disclosedcommand_injection · github_copilot

    record AIR-2026-0981NVD ↗
13. 2026-02-10
    CVE-2026-21523

    CVE-2026-21523: Race condition in GitHub Copilot and Visual Studio

    2 Disclosedtoctou · rce

    record AIR-2026-0962NVD ↗
14. 2026-02-10
    CVE-2026-21516

    CVE-2026-21516: Remote Code Execution via Command Injection in GitHub Copilot

    2 Disclosedgithub-copilot · rce

    record AIR-2026-0961NVD ↗
15. 2026-02-10
    CVE-2026-21256

    CVE-2026-21256: RCE via Command Injection in GitHub Copilot and Visual Studio

    2 Disclosedgithub-copilot · rce

    record AIR-2026-0960NVD ↗
16. 2026-02-10
    CVE-2026-21257

    CVE-2026-21257: Privilege Escalation via Command Injection in GitHub Copilot

    2 Disclosedgithub-copilot · privilege-escalation

    record AIR-2026-0959NVD ↗
17. 2026-02-10
    CVE-2026-21518

    CVE-2026-21518: Command Injection Vulnerability in GitHub Copilot and VS Code

    2 Disclosedgithub-copilot · command-injection

    record AIR-2026-0958NVD ↗
18. 2025-11-20
    CVE-2025-64660

    CVE-2025-64660: GitHub Copilot and VS Code Access Control Vulnerability

    2 Disclosedaccess-control · remote-code-execution

    record AIR-2025-0501NVD ↗
19. 2025-11-11
    CVE-2025-62453

    CVE-2025-62453: GitHub Copilot and VS Code Generative AI Output Validation Flaw

    2 Disclosedoutput-validation · security-bypass

    record AIR-2025-0500NVD ↗
20. 2025-08-12
    CVE-2025-53773

    CVE-2025-53773: Command Injection Vulnerability in GitHub Copilot and Visual Studio

    2 Disclosedcommand-injection · github-copilot

    record AIR-2025-0467NVD ↗

Other incidents: research and unexploited reports · 1

1. 2025-11-07
   Rules File Backdoor: Supply Chain Attack on AI Coding Assistants

   1 Researchsupply-chain · coding-assistant · unicode · backdoor

   record AIR-2025-0065MITRE ATLAS ↗