226 matches found
PoC-CVE-2025-62222
PoC: CVE-2025-62222 - GitHub Copilot Chat RCE This repository contains a Proof of Concept PoC for the vulnerability CVE-2025-62222. It demonstrates how Remote Code Execution RCE can be achieved on a developer's machine by manipulating the context of GitHub Copilot Chat in VS Code via hidden promp...
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026. The campaigns also increase operational pressure on MSSPs serving U...
HarnessSecurity-Bench: Do Security Mechanisms Really Protect Coding Agent Harnesses?
Coding agent harnesses mediate tool use and authorize actions, yet their security mechanisms and runtime effects remain incompletely characterized. We present HarnessSecurity, the first systematic empirical study and benchmark of open- and closed-source coding agent harnesses. First, we derive a...
CVE-2026-81381
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
CVE-2026-81381
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
CVE-2026-81380
Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
CVE-2026-81380
Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
EUVD-2026-73337
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
CVE-2026-81381
CVE-2026-81381 is an information disclosure vulnerability in GitHub Copilot and Visual Studio Code , caused by insufficiently protected credentials. An unauthorized remote attacker can disclose sensitive information over the network with low complexity and no privileges required. NVD assigns a CV...
CVE-2026-81380
CVE-2026-81380 is a command injection flaw in GitHub Copilot and Visual Studio Code that can allow an unauthenticated remote attacker to disclose information over a network . The vulnerability is rated CVSS 3.1 5.3 (MEDIUM) with a high attack complexity, no required privileges, and required user ...
EUVD-2026-73336
Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
CVE-2026-81381: Insufficiently Protected Credentials
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
CVE-2026-81380: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
PT-2026-88065
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
PT-2026-88064
Name of the Vulnerable Software and Affected Versions GitHub Copilot affected versions not specified Visual Studio Code affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to disclos...
Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR
Wiz Red Agent independently discovered and exploited a GitHub Actions injection missed by GitHub’s Advanced Security, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius—all without human intervention, five days after the flaw became live...