Command Injection Vulnerability in Visual Studio Code CoPilot Chat Extension by Microsoft
CVE-2025-62222

8.8HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Visual Studio Code Copilot Chat Extension
Vendor
CVE Published:
11 November 2025

What is CVE-2025-62222?

The Visual Studio Code CoPilot Chat Extension is subject to a command injection vulnerability, which permits unauthorized users to inject and execute arbitrary code remotely. This flaw arises from improper neutralization of special elements in command strings. If exploited, this vulnerability could enable attackers to compromise the integrity and confidentiality of the system. Users and organizations utilizing the affected extension should take proactive steps to mitigate this risk.

Affected Version(s)

Microsoft Visual Studio Code CoPilot Chat Extension Unknown 0.27.0 < 0.32.5

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-62222 : Command Injection Vulnerability in Visual Studio Code CoPilot Chat Extension by Microsoft