Security Update for Microsoft Visual Studio Code CoPilot Chat Extension (November 2025)

#%NASL_MIN_LEVEL 80900
##
# Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(276924);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/16");

  script_cve_id("CVE-2025-62222", "CVE-2025-62449");
  script_xref(name:"IAVA", value:"2025-A-0849-S");

  script_name(english:"Security Update for Microsoft Visual Studio Code CoPilot Chat Extension (November 2025)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The Microsoft Visual Studio Code CoPilot Chat Extension prior to version 0.32.5. It is, therefore, affected 
by multiple vulnerabilities.

  - This vulnerability is a command injection flaw in the Visual Studio Code Copilot Chat Extension, where improper 
    handling of special characters in user-controlled input allows an attacker to inject and execute arbitrary system 
    commands remotely, leading to full compromise of the developer’s environment through unauthorized code execution 
    over the network (CVE-2025-62222).

  - This vulnerability is a path traversal and security feature bypass issue in the GitHub Copilot Chat extension 
    for Visual Studio Code, where improper pathname restrictions allow a local, low-privileged attacker to interact 
    with files outside the intended workspace, potentially exposing or altering sensitive code, configuration files, 
    or credentials when the user interacts with the extension, ultimately resulting in high confidentiality and 
    integrity impact (CVE-2025-62449).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62222");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62449");
  script_set_attribute(attribute:"solution", value:
"Update the Microsoft Visual Studio Code CoPilot Chat Extension to version 0.32.5 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-62222");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:visual_studio_code");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:github_copilot_chat");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("microsoft_visual_studio_code_win_extensions_installed.nbin");
  script_require_keys("installed_sw/Microsoft Visual Studio Code");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'vs-code::copilot-chat', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '0.32.5'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);