PT-2025-32853 · Unknown+1 · Github Copilot+1

Johann Rehberger + 3 · Published 2025-08-12 · Updated 2026-03-14 · CVE-2025-53773

Positive Technologies · (AI Summary)

CVSS v3.1

7.8

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

GitHub Copilot and Visual Studio GitHub Copilot versions prior to 17.14.12 and Visual Studio (affected versions not specified)

Description An improper neutralization of special elements in commands, known as a 'command injection', exists in GitHub Copilot and Visual Studio. This allows an unauthorized attacker to execute code locally. The issue arises from the way the software handles specific elements within commands, potentially enabling malicious code execution through prompt injection. The exploit can overwrite the Copilot configuration file, placing it into a state that allows immediate remote code execution, bypassing user approvals. This vulnerability is considered wormable, meaning it can self-replicate and spread.

Recommendations Update GitHub Copilot to version 17.14.12. Update Visual Studio to the latest available version.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-10171

CVE-2025-53773

Affected Products

Github Copilot

Visual Studio

References · 51

• 🔥 https://github.com/B1ack4sh/Blackash-CVE-2025-53773 · Exploit
• 🔥 https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection · Exploit
• https://osv.dev/vulnerability/CVE-2025-53773 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10171 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53773 · Security Note
• https://twitter.com/0xJin/status/1955586140368441448 · Twitter Post
• https://news.ycombinator.com/item?id=44883108 · Note
• https://twitter.com/ksg93rd/status/1956892585454129199 · Twitter Post
• https://twitter.com/JoshuaOpolko/status/1956770721235181927 · Twitter Post
• https://twitter.com/xhackio/status/2029905924274442521 · Twitter Post
• https://twitter.com/pangeacyber/status/1963331909112549638 · Twitter Post
• https://twitter.com/Dinosn/status/1957303490633408596 · Twitter Post
• https://twitter.com/omniuxai/status/2032878541390364984 · Twitter Post
• https://twitter.com/akaclandestine/status/1988158662477594993 · Twitter Post