CVE-2026-45482

highpriority · track · 0EPSS 0.003 · 28 %ileDEEUNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.34% (28th) EPSS

CVSS 8.4 · high

Is it mine?

39 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedMicrosoft Visual Studio Code CoPilot Chat Extensionmsrc_csaf
1.123.2:Security Update:https://code.visualstudio.com/updates/
https://code.visualstudio.com/updates/

cvss

Technical severity, 0–10. One row per scoring source.

8.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.4highAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.4highCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:Csecondary · ENISA EU

v3.18.4highCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · secure@microsoft.com USexploitability 2.5 · impact 5.9

v3.17.7highCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.18.4highCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

v3.18.4highCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:Csecondary · Microsoft Security Response Center US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USCWE-22USCWE-22USCWE-22US

affected products (39)

Products and version ranges known to be affected.

Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Microsoft .NET 10.0all versionscert_bundDEcpe:/a:microsoft:.net:10.0
Microsoft .NET 8.0all versionscert_bundDEcpe:/a:microsoft:.net:8.0
Microsoft .NET 9.0all versionscert_bundDEcpe:/a:microsoft:.net:9.0
Microsoft ASP.NET Core 10.0all versionscert_bundDEcpe:/a:microsoft:asp.net:core_10.0
Microsoft ASP.NET Core 8.0all versionscert_bundDEcpe:/a:microsoft:asp.net:core_8.0
Microsoft ASP.NET Core 9.0all versionscert_bundDEcpe:/a:microsoft:asp.net:core_9.0
Microsoft Visual Studio 2026 version 18.6all versionscert_bundDE
Microsoft Visual Studio Codeall versionscert_bundDEcpe:/a:microsoft:visual_studio_code:-
Microsoft Visual Studio Code - MSSQL Extensionall versionscert_bundDEcpe:/a:microsoft:visual_studio_code:-_mssql_extension
Microsoft Visual Studio Code CoPilot Chat Extensionall versionscert_bundDEcpe:/a:microsoft:visual_studio_code:copilot_chat_extension
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Microsoft Visual Studio 2026≤ version 18.6cert_bundDE
Microsoft Microsoft Visual Studio Code CoPilot Chat Extension0.27.0 → 1.123.2enisa_euvdEU
Microsoft Corp Microsoft Visual Studio Code CoPilot Chat Extension≤ 1.123.2fstec_bduRU
Microsoft Microsoft Visual Studio Code CoPilot Chat Extensionall versionsfixedmsrc_csafUS
Microsoft Microsoft Visual Studio Code CoPilot Chat Extension< 1.123.2msrc_csafUS

showing 20 of 39

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2026-0184Kwetsbaarheden verholpen in Microsoft Developer ToolsNL2026-06-09csaf · ncsc_nlNL
Microsoft heeft kwetsbaarheden verholpen in Developer Tools.
WID-SEC-W-2026-1845Microsoft DeveloperTools: Mehrere SchwachstellenDeutsch2026-06-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio Code, Microsoft ASP.NET, Microsoft .NET und Microsoft Visual Studio 2026 ausnutzen, um Administratorrechte zu erlangen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder die Authentifizierung zu umgehen.
msrc_CVE-2026-45482Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability2026-06-09csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund msrc_csaf ncsc_nl NVD CVE.org MITRE

published 2026-06-09modified 2026-07-23

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan