A critical command injection vulnerability in the Microsoft GitHub Copilot plugin for JetBrains IDEs permits local code execution by an unauthenticated attacker.

The plugin fails to properly neutralize special elements used in commands, leading to a command injection vulnerability (CWE-77). This flaw allows an unauthenticated attacker to execute code locally on the host machine.

This vulnerability carries a CVSS score of 8.4, reflecting the high severity of potential local code execution. Successful exploitation could lead to full system compromise, unauthorized access to source code, and the potential for lateral movement within the development environment, resulting in significant security and operational risks.

Immediate Action: Update the GitHub Copilot plugin within your JetBrains IDE environment to version 1.5.60-243 or later to resolve the underlying command injection flaw.

Proactive Monitoring: Review local system logs and IDE activity logs for anomalous process execution or unexpected command-line arguments originating from the plugin process.

Compensating Controls: Ensure that development environments are isolated and that users operate with the principle of least privilege to minimize the potential impact of local code execution.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the potential for complete system compromise, organizations should prioritize updating all instances of the GitHub Copilot plugin for JetBrains IDEs. Developers should verify their current version and apply the vendor-provided patch immediately to mitigate the risk of unauthorized local code execution.