PT-2026-40261

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to perform tampering over a network...

PT-2026-40239

Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot for Android affected versions not specified Description Improper access control in the intelligent virtual assistant allows an authorized attacker to perform spoofing attacks locally. Spoofing is a technique where a perso...

KLA91041 Multiple vulnerabilities in Microsoft Apps

Multiple vulnerabilities were found in Microsoft Apps. Malicious users can exploit these vulnerabilities to spoof user interface, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A spoofing vulnerability in Microsoft 365 Copilot for Android can be exploited remotely t...

PT-2026-40250

Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally...

Microsoft M365 Copilot 访问控制错误漏洞

Microsoft M365 Copilot is an AI-driven productivity tool developed by the American company Microsoft. There is a security access control vulnerability in Microsoft M365 Copilot. Attackers exploit this vulnerability to carry out phishing attacks...

The vulnerability of the Business Chat function in the Microsoft 365 Copilot intelligent virtual assistant allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Business Chat function in Microsoft 365 Copilot relates to the failure to take measures to neutralize special elements. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2026-41109: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper neutralization of special elements in output used by a downstream component 'injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network...

Microsoft GitHub Copilot and Visual Studio 注入漏洞

Microsoft GitHub Copilot and Visual Studio are generative AI tools developed by the American company Microsoft. There are injection vulnerabilities in Microsoft GitHub Copilot and Visual Studio. Attackers can exploit these vulnerabilities to bypass certain features...

CVE-2026-42893: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to perform tampering over a network...

Microsoft M365 Copilot 访问控制错误漏洞

Microsoft M365 Copilot is an AI-driven productivity tool developed by the American company Microsoft. There is a security access control vulnerability in Microsoft M365 Copilot. Attackers exploit this vulnerability to carry out phishing attacks...

PT-2026-40244

Name of the Vulnerable Software and Affected Versions GitHub Copilot affected versions not specified Visual Studio affected versions not specified Description Improper neutralization of special elements in output used by a downstream component, known as injection, allows an unauthorized attacker ...

CVE-2026-41614: Improper Access Control

Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally...

CVE-2026-41100: Improper Access Control

Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally...

CVE-2026-42869 SOCFortress CoPilot: Hardcoded JWT secret allows unauthenticated full admin compromise and lateral movement into all integrated SOC tools

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded JWT signing secret as a fallback value in backend/app/auth/utils.py:28 and ships it verbatim in .env.example. Any deployment where JWTSECR...

@hyorman/copilot-proxy-cli (>=1.0.4, <=1.0.5), @senoldogann/code-companion (>=0.1.38, <=0.1.56) +8 more potentially affected by CVE-2026-45033 via @github/copilot (>=1.0.12, <=1.0.40)

@github/copilot NPM version =1.0.12, =1.0.4, =0.1.38, =0.12.6, =0.8.5, =0.6.0, =0.6.1, =0.6.8, =1.0.0, =2.0.0 - @vibe-forge/client 1.0.0 - bitbucket-copilot-pr-review 0.5.1 Source cves: CVE-2026-45033 Source advisory: OSV:GHSA-9CCR-R5HG-74GF...

GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor

Summary A security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory...

@hyorman/copilot-proxy-cli (>=1.0.4, <=1.0.5), @senoldogann/code-companion (>=0.1.38, <=0.1.56) +8 more potentially affected by CVE-2026-45033 via @github/copilot (>=1.0.12, <=1.0.40)

@github/copilot NPM version =1.0.12, =1.0.4, =0.1.38, =0.12.6, =0.8.5, =0.6.0, =0.6.1, =0.6.8, =1.0.0, =2.0.0 - @vibe-forge/client 1.0.0 - bitbucket-copilot-pr-review 0.5.1 Source cves: CVE-2026-45033 Source advisory: SNYK:JS-GITHUBCOPILOT-16642141...

GHSA-9CCR-R5HG-74GF GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor

Summary A security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory...

Incorrect Behavior Order

Overview @github/copilot is a GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal. Affected versions of this package are vulnerable to Incorrect Behavior Order that enables code execution via the core.fsmonitor configuration key in a nested bare git repository. A...

PT-2026-39901

Name of the Vulnerable Software and Affected Versions GitHub Copilot CLI versions prior to 1.0.43 Description An issue exists where a malicious bare git repository nested inside a project directory can lead to arbitrary code execution when the agent performs git operations. By exploiting git's...