CVE-2026-21523CWE-367

GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability

High · published February 10, 2026

CVSS v3.1
8.0
EPSS
1%
Percentile
55.4
In the wild
Unconfirmed
What it is

⚡ A timing issue is the secret weapon here! An authorized attacker can exploit a sneaky race condition in GitHub Copilot and Visual Studio to execute code over the network! Think of it like a relay race where the baton is passed too soon—if the next runner is already halfway down the track before the baton is securely in hand, chaos can ensue. This vulnerability is that moment when the timing goes awry, allowing unexpected code to run. An attacker could potentially run malicious code on your system, compromising your data and security. It's like giving someone a backstage pass to your concert—they could mess with the show before you even realize it! With this vulnerability, the stakes are high, and the potential damage could be quite significant.

Put simply

Think of it like a relay race where the baton is passed too soon—if the next runner is already halfway down the track before the baton is securely in hand, chaos can ensue. This vulnerability is that moment when the timing goes awry, allowing unexpected code to run. This vulnerability arises from a time-of-check to time-of-use race condition, which occurs when an authorized user can exploit the timing discrepancy to execute malicious code over the network, bypassing intended safeguards and controls.

What to do

An attacker could potentially run malicious code on your system, compromising your data and security. It's like giving someone a backstage pass to your concert—they could mess with the show before you even realize it! With this vulnerability, the stakes are high, and the potential damage could be quite significant. Update GitHub Copilot and Visual Studio to the latest versions to patch this vulnerability. Additionally, conduct a thorough review of your access controls and monitoring to catch any suspicious activities. Don't forget to educate your team on secure coding practices! You've got this! With these steps, you'll be one step closer to fortifying your defenses! 🛡️

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00775 · 55.4th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-02-10T17:51Z
EPSS history
Timeline
  • 10 FEB 17:51Z
    GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
    cvelistv5