SB20260210107 - Multiple vulnerabilities in Microsoft GitHub Copilot and Visual Studio

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260210107

SB20260210107 - Multiple vulnerabilities in Microsoft GitHub Copilot and Visual Studio

Published: February 10, 2026 Updated: February 19, 2026

Security Bulletin ID SB20260210107
Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Command Injection (CVE-ID: CVE-2026-21518)

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation in GitHub Copilot and Visual Studio Code where workspace trust was not always demanded to start MCP servers. A remote attacker can pass specially crafted data to the application and execute arbitrary commands.


2) Command Injection (CVE-ID: CVE-2026-21256)

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation in GitHub Copilot and Visual Studio. A remote attacker can pass specially crafted data to the application and execute arbitrary commands.


3) Command Injection (CVE-ID: CVE-2026-21257)

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation in GitHub Copilot and Visual Studio. A remote user can pass specially crafted data to the application and execute arbitrary commands.


4) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-21523)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a race condition in GitHub Copilot and Visual Studio where terminal.integrated.autoReplies can cause commands to be repeatedly auto-executed in previously trusted folders, and the behavior persists across folders until a completely new window is opened.. A remote user can execute arbitrary code on the system.


Remediation

Install update from vendor's website.

References