Wunderwuzzi23

An improper neutralization of special elements used in a command ('command injection') exists in M365 Copilot. This allows an unauthorized attacker to disclose information over a network.

Cursor, a code editor for programming with AI, has an issue where Mermaid, used for rendering diagrams, allows embedding images. This can be exploited to exfiltrate sensitive information to a third-party attacker-controlled server through an image fetch, following a successful prompt injection. A malicious model or backdoor could also trigger this exploit. The issue requires prompt injection from malicious data such as web content, image uploads, or source code to be successfully exploited. The `image fetch` mechanism is used to transmit data to an external server controlled by the attacker.

Name of the Vulnerable Software and Affected Versions: Claude Code versions prior to 1.0.4 Claude Code versions prior to 1.0.24 Description: Claude Code is an agentic coding tool. Prior to version 1.0.4, it’s possible to bypass the confirmation prompts to read a file and then send file contents over the network without user confirmation due to an overly broad allowlist of safe commands. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Recommendations: Update to version 1.0.4 or later. Update to version 1.0.24 or later.

Improper neutralization of special elements used in a command leads to a command injection issue in GitHub Copilot and Visual Studio, allowing an unauthorized attacker to execute code locally. This can be achieved through prompt injection, where an attacker hides malicious instructions within a repository comment, README, or PR description. The AI assistant may be tricked into modifying the `.vscode/settings.json` file to enable an auto-approve mode, which allows the agent to execute arbitrary bash commands in the terminal without human confirmation.

Cursor is a code editor built for programming with AI. In versions below 1.3, Mermaid, a tool used for rendering diagrams, allows embedding images. An attacker can leverage this functionality to exfiltrate sensitive information to an attacker-controlled server through an image fetch following a successful prompt injection. A malicious model or backdoor could also trigger this exploit. The issue requires prompt injection from malicious data sources such as web content, image uploads, or source code. This can result in sensitive information being sent to an attacker-controlled external server. The vulnerability involves a combination of factors: Copilot can call tools like `search enterprise emails` within a tenant context and include the results in generated output, and Mermaid artifacts support clickable links, creating an unexpected exfiltration channel. The exploitation chain involves embedding hidden instructions in a document to collect data, Copilot gathering tenant data through available tools, the data being encoded and inserted into a Mermaid diagram, the diagram rendering as an interactive object with links, and a client or browser making a request to a command and control server when the link is clicked, allowing the attacker to collect the data.