GitHub Copilot and Visual Studio Flaws Let Attackers Bypass Security Protections

Microsoft has disclosed two critical security vulnerabilities affecting GitHub Copilot and Visual Studio Code, which could allow attackers to bypass important security protections. Both flaws were reported on 11 November 2025 and carry “Important” severity ratings, with CVSS scores of 6.8 for CVE-2025-62449 and 5.0 for CVE-2025-62453.

CVE-2025-62449 affects the Microsoft Visual Studio Code Copilot Chat Extension and stems from improper path-traversal handling (CWE-22); attackers with local access and limited privileges can exploit it, with the flaw requiring user interaction. The second vulnerability, CVE-2025-62453, impacts both GitHub Copilot and Visual Studio Code and involves improper validation of generative AI output, enabling broader protection failures.

The flaws create multiple attack vectors for malicious actors, including potential access to source code repositories, configuration files and development secrets, and could lead to the injection of compromised code into projects. Microsoft has released fixes for both vulnerabilities, making updates essential for maintaining security posture.