Microsoft Microsoft Visual Studio Code CoPilot Chat Extension

Name: Microsoft Microsoft Visual Studio Code CoPilot Chat Extension
Brand: Microsoft

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

1critical8high7medium0low

updated 2026-10-28

vulnerabilities (78)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-62222US	—	0.80% (56th)	Exploit	0.32.5	2025-11-11	2 versions
CVE-2026-50649US	—	4.02% (91st)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-50646US	—	4.02% (91st)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-45591US	—	2.48% (84th)	—	no fix	2026-06-09	≤ vers:unknown/*
CVE-2026-32178US	—	2.28% (83rd)	—	no fix	2026-04-14	≤ vers:unknown/*
CVE-2026-33116US	—	2.14% (82nd)	—	no fix	2026-04-14	≤ vers:unknown/*
CVE-2026-32203US	—	1.90% (80th)	—	no fix	2026-04-14	≤ vers:unknown/*
CVE-2026-26171US	—	1.75% (78th)	—	no fix	2026-04-14	≤ vers:unknown/*
CVE-2026-21518US	—	1.46% (73rd)	—	0.37.1	2026-02-10	0.27.0 → 0.37.1
CVE-2026-23666US	—	1.33% (71st)	—	no fix	2026-04-14	≤ vers:unknown/*
CVE-2026-62901US	—	1.23% (69th)	—	no fix	2026-08-11	≤ vers:unknown/*
CVE-2026-50524US	—	1.23% (69th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-50651US	—	1.17% (67th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-50648US	—	1.17% (67th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-50527US	—	1.17% (67th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-50525US	—	1.17% (67th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-47302US	—	1.17% (67th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-57108US	—	1.17% (67th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-56170US	—	1.17% (67th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-50506US	—	1.17% (67th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-45646US	—	1.17% (67th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2025-62214US	—	1.11% (66th)	—	no fix	2025-11-11	≤ vers:unknown/*
CVE-2026-47284US	—	1.01% (63rd)	—	no fix	2026-06-09	≤ vers:unknown/*
CVE-2026-70337US	—	0.94% (61st)	—	no fix	2026-08-11	≤ vers:unknown/*
CVE-2026-47285US	—	0.92% (60th)	—	no fix	2026-08-11	≤ vers:unknown/*
CVE-2026-58612US	high7.5	0.87% (59th)	—	no fix	2026-08-11	≤ vers:unknown/*
CVE-2026-62902US	—	0.87% (59th)	—	no fix	2026-08-11	≤ vers:unknown/*
CVE-2026-47282US	—	0.87% (59th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-69320US	—	0.86% (58th)	—	no fix	2026-08-11	≤ vers:unknown/*
CVE-2026-41109US	—	0.86% (58th)	—	no fix	2026-05-12	≤ vers:unknown/*
CVE-2026-47303US	—OT elevated	0.84% (58th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-47281US	—OT elevated	0.83% (57th)	—	no fix	2026-06-09	≤ vers:unknown/*
CVE-2026-57102US	—	0.82% (57th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-70336US	high8.8	0.82% (57th)	—	no fix	2026-08-11	≤ vers:unknown/*
CVE-2026-47287US	—	0.79% (56th)	—	no fix	2026-06-09	≤ vers:unknown/*
CVE-2025-21264US	—	0.79% (56th)	—	0.27.2	2025-05-13	0.27.0 → 0.27.2
CVE-2026-62872US	—OT elevated	0.78% (56th)	—	no fix	2026-08-11	≤ vers:unknown/*
CVE-2026-47300US	—	0.78% (56th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-21523US	—	0.78% (56th)	—	0.37.1	2026-02-10	0.27.0 → 0.37.1
CVE-2026-59113US	—OT elevated	0.76% (55th)	—	no fix	2026-08-11	≤ vers:unknown/*
CVE-2026-62900US	—	0.75% (55th)	—	no fix	2026-08-11	≤ vers:unknown/*
CVE-2026-62899US	—	0.75% (55th)	—	no fix	2026-08-11	≤ vers:unknown/*
CVE-2026-23653US	medium6.5	0.74% (54th)	—	0.37.3	2026-04-14	4 versions
CVE-2026-50659US	—	0.74% (54th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-40376US	high8.1	0.67% (52nd)	—	no fix	2026-06-09	≤ vers:unknown/*
CVE-2026-65675US	medium6.5OT elevated	0.64% (50th)	—	1.132.1	2026-08-11	4 versions
CVE-2026-50528US	—OT elevated	0.61% (49th)	—	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-45644US	—	0.55% (46th)	—	no fix	2026-06-09	≤ vers:unknown/*
CVE-2026-32226US	—	0.54% (45th)	—	no fix	2026-04-14	≤ vers:unknown/*
CVE-2026-69306US	—	0.54% (45th)	—	no fix	2026-08-11	≤ vers:unknown/*

showing 50 of 78

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-770Allocation of Resources Without Limits or Throttling8 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')7 CVEs
CWE-20Improper Input Validation6 CVEs
CWE-693Protection Mechanism Failure6 CVEs
CWE-863Incorrect Authorization5 CVEs
CWE-23Relative Path Traversal4 CVEs
CWE-787Out-of-bounds Write4 CVEs
CWE-829Inclusion of Functionality from Untrusted Control Sphere4 CVEs

sources (3)

Which sources assert this record, and when.

NLNCSC-NL (CSAF)75 CVEs
EUEU Vulnerability Database (ENISA)8 CVEs
USMicrosoft MSRC (CSAF)3 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan