Skip to content
AI News HubLIVE
More
Summary only

RCE in VSCode Copilot Chat

Researchers discovered a prompt injection vulnerability in VSCode Copilot's agent mode, allowing attackers to bypass user confirmation by exploiting a TOCTOU flaw in the applyPatch tool, leading to arbitrary file write and remote code execution via overwriting .git/config or shell configuration files.

SourceHacker News AIAuthor: speckx
RCE in VSCode Copilot Chat
Report an error

The correction channel is not available yet. You can copy the article reference below for later.

Correction instructions

Summary only

Under the source content permission, this page provides an editorial summary, key points, and a link to the original article.

Key points and analysis

Article intelligence

EngineersIntermediate

Key points

  • Copilot agent mode vulnerable to prompt injection, automatically processes malicious GitHub Issue content.
  • TOCTOU vulnerability in applyPatch tool: file rename operation bypasses destination path checks.
  • Attackers can craft patches that overwrite sensitive files like .git/config to achieve RCE.
  • Exploitation requires specific models (e.g., GPT-4.1) and Claude models disabled.

Highlights and analysis are generated automatically and may contain errors. Check the original source.

More recent stories on this topic · Agents