Race Condition in GitHub Copilot and Visual Studio Products
CVE-2026-21523

8HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Visual Studio Code Copilot Chat Extension
Visual Studio Code
Vendor
CVE Published:
10 February 2026

What is CVE-2026-21523?

A vulnerability exists within GitHub Copilot and Visual Studio due to a time-of-check, time-of-use (TOCTOU) race condition. This flaw allows an authorized attacker to exploit the timing window to execute arbitrary code over the network, potentially leading to unauthorized actions within the affected software environments. It is essential for users to review the latest patches and implement security best practices to mitigate any risk associated with this vulnerability.

Affected Version(s)

Microsoft Visual Studio Code CoPilot Chat Extension 0.27.0 < 0.37.1

Visual Studio Code 1.0.0 < 1.109.2

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.