The GitHub Copilot plugin for JetBrains IDEs contains a critical command injection vulnerability that permits unauthorized remote code execution.

This flaw is a command injection (CWE-77) occurring due to improper neutralization of special elements in commands, which allows an unauthenticated attacker to execute code over a network.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code, which can lead to a full compromise of the developer workstation. Given the CVSS score of 8.8, this poses a significant risk to organizational intellectual property, source code integrity, and potentially internal network access.

Immediate Action: Update the GitHub Copilot plugin for all affected JetBrains IDE installations to version 1.5.63 or later immediately.

Proactive Monitoring: Monitor developer workstation logs for unusual outbound network connections or unexpected process execution patterns originating from the IDE environment.

Compensating Controls: Ensure developer workstations are behind robust endpoint protection solutions and restrict network access to untrusted external sources where possible.

Public Exploit Available: Unknown.

The severity of this command injection vulnerability cannot be overstated, as it provides a direct path for attackers to gain control over development environments. Organizations should prioritize the deployment of the vendor-supplied security update to all affected JetBrains IDE instances to mitigate the risk of unauthorized code execution and potential downstream supply chain attacks.