PT-2025-32853 · Microsoft+1 · Visual Studio+1

Johann Rehberger + 3 · Published 2025-08-12 · Updated 2026-06-01 · CVE-2025-53773

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitHub Copilot (affected versions not specified) Visual Studio 2022 versions prior to 17.14.12

Description Improper neutralization of special elements used in a command, known as command injection, in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally. This issue can be triggered via prompt injection, which is a technique used to manipulate the instructions provided to a Large Language Model (LLM) to make it perform unintended actions. In some cases, this may lead to wormable command execution.

Recommendations Update Visual Studio 2022 to version 17.14.12. At the moment, there is no information about a newer version that contains a fix for this vulnerability regarding GitHub Copilot.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-10171

CVE-2025-53773

Affected Products

Github Copilot

Visual Studio

References · 58

• 🔥 https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection · Exploit
• 🔥 https://github.com/B1ack4sh/Blackash-CVE-2025-53773 · Exploit
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53773 · Security Note
• https://bdu.fstec.ru/vul/2025-10171 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53773 · Vendor Advisory
• https://twitter.com/akaclandestine/status/1988158662477594993 · Twitter Post
• https://twitter.com/battou_dev/status/1955768132812898361 · Twitter Post
• https://twitter.com/0xJin/status/1955586140368441448 · Twitter Post
• https://t.me/CyberSecurityTechnologies/12260 · Telegram Post
• https://t.me/cveNotify/131991 · Telegram Post
• https://twitter.com/veriprajna/status/2041072526797983751 · Twitter Post
• https://twitter.com/CyberStrategy1/status/2011487559478636941 · Twitter Post
• https://twitter.com/marver/status/1955572832303550524 · Twitter Post
• https://twitter.com/omniuxai/status/2032878541390364984 · Twitter Post