Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.119.1CPE matchmatch criteria | cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:* | ||
>= 1.0.0, < 1.128.1CPE match | cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.