CVE-2026-50510

Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.

Scoring

Severity

HIGH

CVSS base score

7.8

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

EPSS probability

0.36%

CWE

CWE-641

Published

2026-07-14

Last modified

2026-09-09

Affected products

• Microsoft GitHub Copilot Plugin for JetBrains IDEs

Weakness type

• CWE-641

Related vulnerabilities

• CVE-2026-46581 — In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not...
• CVE-2026-50023 — yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
• CVE-2019-25623 — Luminance Studio 2.17 Denial of Service via Malformed Input
• CVE-2026-25177 — Active Directory Domain Services Elevation of Privilege Vulnerability
• CVE-2025-47173 — Microsoft Office Remote Code Execution Vulnerability
• CVE-2025-47953 — Microsoft Office Remote Code Execution Vulnerability
• CVE-2024-47260 — 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did...
• CVE-2025-21402 — Microsoft Office OneNote Remote Code Execution Vulnerability

Markdown version · Browse all CVEs