CVE-2025-66389

Name of the Vulnerable Software and Affected Versions GitHub Copilot version 1.372.0

Description An issue exists where the software allows filesystem access outside of a workspace folder without user approval. This occurs via a file-handler URI parameter used in the fetch webpage() function. This flaw could lead to data exfiltration if an indirect prompt injection is performed. Indirect prompt injection is a technique where an attacker places malicious instructions in a data source that the AI model processes, causing it to execute unintended actions.

Recommendations As a temporary mitigation, restrict the use of the fetch webpage() function or avoid processing untrusted external data that could trigger prompt injections until a fix is available for version 1.372.0.