{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21523", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-12-30T18:10:54.846Z", "datePublished": "2026-02-10T17:51:25.077Z", "dateUpdated": "2026-05-11T21:25:52.975Z"}, "containers": {"cna": {"title": "GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability", "datePublic": "2026-02-10T16:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_code_copilot_chat_extension:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.27.0", "versionEndExcluding": "0.37.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "1.110.1"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Visual Studio Code CoPilot Chat Extension", "versions": [{"version": "0.27.0", "lessThan": "0.37.1", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Visual Studio Code", "versions": [{"version": "1.0.0", "lessThan": "1.110.1", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", "lang": "en-US", "type": "CWE", "cweId": "CWE-367"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-05-11T21:25:52.975Z"}, "references": [{"name": "GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21523", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T04:56:12.023429Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:47.813Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21523", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T04:56:12.023429Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:43:21.756Z"}}], "cna": {"title": "GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Visual Studio Code CoPilot Chat Extension", "versions": [{"status": "affected", "version": "0.27.0", "lessThan": "0.37.1", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Visual Studio Code", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.110.1", "versionType": "custom"}]}], "datePublic": "2026-02-10T16:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523", "name": "GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:visual_studio_code_copilot_chat_extension:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "0.37.1", "versionStartIncluding": "0.27.0"}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.110.1", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-05-11T18:10:35.519Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21523", "state": "PUBLISHED", "dateUpdated": "2026-05-11T18:10:35.519Z", "dateReserved": "2025-12-30T18:10:54.846Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-02-10T17:51:25.077Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:-:*:*", "matchCriteriaId": "F9D09E0D-DA79-4992-848B-EFF81DBD4099", "versionEndExcluding": "1.109.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network."}], "id": "CVE-2026-21523", "lastModified": "2026-02-11T21:41:36.627", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Primary"}]}, "published": "2026-02-10T18:16:34.743", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "secure@microsoft.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.109.2)"}}], "product": "visual_studio_code", "vendor": "microsoft"}], "analysis": {"en": {"generated_at": "2026-04-15T17:25:36.201894+00:00", "value": {"mitigation_remediation": ["Apply Microsoft\u2019s latest security update that resolves the race condition in the GitHub Copilot Chat extension for Visual Studio Code.", "Upgrade Visual Studio Code to the newest stable release, which includes the same fix.", "If an update cannot be applied immediately, temporarily uninstall or disable the Copilot Chat extension until the patch is released.", "Limit network access for accounts that have the extension installed to reduce the window for exploitation."], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Microsoft Visual Studio Code and specifically the Copilot Chat extension installed from GitHub Copilot. All users running these components are potentially impacted until a patch is applied.", "description_and_impact": "A Time-of-Check Time-of-Use race condition has been discovered in the GitHub Copilot Chat extension for Visual Studio Code. The flaw allows an attacker who has authorized access to the local environment to execute arbitrary code over a network connection. This type of vulnerability provides a high level of privilege escalation, potentially giving the attacker full control of the affected system.", "risk_and_exploitability": "The CVSS base score of 8.0 indicates a high severity scenario. The EPSS score is below 1%, suggesting that, currently, exploitation attempts are unlikely to be widespread. However, the vulnerability is already cataloged by the Microsoft Security Response Center and was not listed in the CISA KEV catalog, meaning that there is no publicly known active exploitation. The attack vector is likely local, requiring an authorized user to trigger the race condition, after which malicious code can be executed remotely. The overall risk remains significant due to the high impact of remote code execution."}}}}, "created": "2026-02-10T21:33:47.414227+00:00", "updated": "2026-04-15T17:45:10.826517+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$visual_studio_code"]}