What’s Vulnerable › Vulnerabilities

CVE-2025-66389

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-22 · updated 2026-10-12
• Weakness: CWE-552

Description

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.

Affected products

• Microsoft GitHub Copilot Plugin for JetBrains IDEs: 1.372.0

References

• https://blindcyber.com/2025/10/28/copilot-fun/
• https://github.com/microsoft/vscode-copilot-chat/
• https://github.com/microsoft/vscode/blob/03baef1008086ed4960042fa463e570072173bb5/src/vs/workbench/contrib/chat/electron-browser/tools/fetchPageTool.ts#L152

Get alerted when CVE-2025-66389 or the next vulnerability affects your stack