What it is about

Microsoft GitHub Copilot ist ein KI-gestützter Programmierassistent, der Codevorschläge und Vervollständigungen direkt in der Entwicklungsumgebung bietet. Ein lokaler Angreifer kann eine Schwachstelle in Microsoft GitHub Copilot ausnutzen, um beliebigen Programmcode auszuführen.

Under what conditions?

Only with access to the device or an account on it. Often the second step after a phishing email.

What can happen in the worst case

An attacker could use the vulnerability to

• beliebigen Programmcode auszuführen

Am I affected?

Affected according to the BSI:

• Microsoft GitHub Copilot CLI <1.0.43

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• Microsoft GitHub Copilot CLI 1.0.43

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.