GitHub Copilot and Visual Studio prompt injection code execution flaw (CVE-2025-53773)

CVE-2025-53773 is a command injection vulnerability in GitHub Copilot and Visual Studio that allowed an attacker to get code executed on a developer's machine. The record was published on 12 August 2025 with a CVSS base score of 7.8, and the National Vulnerability Database links it to a third-party write-up on remote code execution via prompt injection.

What happened

Later that month GitHub described a related class of weaknesses in the Copilot agent for VS Code: when the agent edits a file, the change is already written to disk by the time the user is asked to keep or undo it. Settings and MCP configuration files are reloaded after each change, and because MCP servers can be launched from shell commands, an injected instruction that rewrites those files can start an arbitrary command.

GitHub said several outside researchers had separately reported the same underlying weakness around immediate file changes. The malicious instructions can arrive through content the agent reads, such as a GitHub issue or pull request.

Impact

The Microsoft-supplied score rates the attack as local and requiring user interaction. GitHub wrote that the agent-mode issues it examined could have let attackers leak local GitHub tokens, reach sensitive files or run arbitrary code without confirmation. Neither source reports exploitation against real users.

Response

The vulnerability record lists Visual Studio 2022 versions from 17.14.0 up to, but not including, 17.14.12 as affected. GitHub said VS Code no longer lets the agent edit files outside the workspace, and that further protections would force user confirmation before sensitive files such as configuration files are changed.

Lessons for security leaders

• An agent that can change its own configuration can grant itself new powers. Protect agent settings files the way you protect sudoers or startup scripts.
• Keep IDEs and AI extensions on a managed update channel, and confirm builds are past the first fixed version, so vendor fixes arrive without waiting on individual developers.
• Open untrusted repositories in restricted or sandboxed modes, such as containers or cloud workspaces, before letting an agent act on them.
• Use enterprise policy controls to switch off agent capabilities your teams do not need.