CVE-2026-70335: GitHub Copilot Privilege Escalation Flaw

CVE-2026-70335 Overview

CVE-2026-70335 is an OS command injection vulnerability affecting GitHub Copilot and Visual Studio Code. The flaw allows an unauthorized attacker to elevate privileges locally by supplying crafted input that is passed to an operating system command without proper neutralization of special elements. The vulnerability is tracked under CWE-78 and carries a CVSS 3.1 base score of 7.8. Exploitation requires local access and user interaction, but no privileges are needed prior to the attack. Successful exploitation results in high impact to confidentiality, integrity, and availability on the affected host.

Critical Impact
An attacker who convinces a developer to open or interact with malicious content in Visual Studio Code with GitHub Copilot can execute arbitrary operating system commands in the context of the local user, leading to privilege escalation on the workstation.

Affected Products

GitHub Copilot
Visual Studio Code
Developer workstations running vulnerable versions of the Copilot extension within VS Code

Discovery Timeline

2026-08-11 - CVE-2026-70335 published to the National Vulnerability Database
2026-08-11 - Last updated in the NVD database

Technical Details for CVE-2026-70335

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements passed into an operating system command inside GitHub Copilot and Visual Studio Code. When user- or content-controlled data reaches a shell or command-execution routine without sanitization, the interpreter treats embedded metacharacters as command syntax rather than data. This allows an attacker to append or substitute their own commands into the invocation.

Because the affected components run inside the developer's editor session, injected commands execute with the privileges of the interactive user. On a typical developer workstation those privileges include write access to source repositories, cached credentials, SSH keys, and cloud-provider tokens. The CVSS vector indicates local attack vector with required user interaction, consistent with a scenario in which a developer opens a crafted workspace, file, or Copilot prompt that triggers the sink.

Root Cause

The root cause is a Command Injection weakness classified as [CWE-78]. The affected code paths in Copilot and Visual Studio Code concatenate untrusted input into an OS command string instead of using safe argument-array APIs or performing strict allowlist validation. Shell metacharacters such as ;, &&, |, backticks, and $() are not neutralized before the command reaches the operating system.

Attack Vector

Exploitation requires that a developer open or interact with attacker-controlled content in Visual Studio Code where GitHub Copilot is active. The malicious content, which can be delivered through a repository, workspace file, Copilot chat context, or an extension asset, contains crafted strings that reach the vulnerable command sink. Once the sink executes, the injected commands run under the developer's user account. From that foothold an attacker can pivot to installed tooling, stored credentials, and any elevation primitives available on the workstation.

No verified proof-of-concept has been published. See the Microsoft CVE-2026-70335 Advisory for vendor technical details.

Detection Methods for CVE-2026-70335

Indicators of Compromise

Unexpected child processes spawned by Code.exe, code, or Copilot extension host processes, particularly shells such as cmd.exe, powershell.exe, bash, or sh.
Command lines containing shell metacharacters (;, &&, |, $(), backticks) originating from Visual Studio Code process trees.
Outbound network connections from editor child processes to previously unseen domains shortly after opening a new repository or workspace.
Creation or modification of files under user profile directories (SSH keys, cloud credentials, scheduled tasks, autostart entries) by processes descending from Visual Studio Code.

Detection Strategies

Build endpoint detection rules that alert on shell interpreters launched as children of Code.exe or the Copilot extension host, correlating with suspicious command-line arguments.
Hunt for process-lineage patterns where Visual Studio Code spawns interpreters that then spawn network utilities such as curl, wget, certutil, or Invoke-WebRequest.
Monitor for enumeration of credential stores, .aws, .azure, .ssh, and .git-credentials paths by editor-descended processes.

Monitoring Recommendations

Enable command-line and process-creation logging (Windows Event ID 4688 with command line, Sysmon Event ID 1, macOS EndpointSecurity, Linux auditd execve) across developer endpoints.
Forward process telemetry to a central analytics platform and retain at least 30 days of history for retrospective hunting once IOCs are published.
Track Visual Studio Code and GitHub Copilot extension versions across the fleet and alert on hosts running versions predating the vendor fix.

How to Mitigate CVE-2026-70335

Immediate Actions Required

Update Visual Studio Code and the GitHub Copilot extension to the fixed versions referenced in the Microsoft CVE-2026-70335 Advisory.
Instruct developers not to open untrusted repositories, workspaces, or Copilot prompt content from unknown sources until patching is confirmed.
Inventory all developer endpoints and confirm the presence of the patched Copilot extension build through a software-management tool.
Rotate credentials, tokens, and SSH keys stored on any workstation suspected of exposure to malicious workspaces.

Patch Information

Microsoft has issued guidance for CVE-2026-70335 through the Microsoft Security Response Center. Refer to the Microsoft CVE-2026-70335 Advisory for the specific fixed versions of Visual Studio Code and the GitHub Copilot extension. Apply updates through the Visual Studio Code auto-update mechanism or by pushing the updated extension package through enterprise deployment tooling.

Workarounds

Enable Visual Studio Code Workspace Trust and require explicit trust before executing workspace-provided tasks or extensions.
Restrict the GitHub Copilot extension to trusted workspaces only, and disable it for repositories cloned from untrusted sources.
Apply application-control policies that block editor child processes from launching shell interpreters where developer workflows do not require it.

bash

# Configuration example: verify installed VS Code and Copilot extension versions
code --version
code --list-extensions --show-versions | grep -i copilot