CVE-2026-50510 - Vulnerability Details - OpenCVE

Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Microsoft	Gihub Copilot Plugin For Jetbrains Ides

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50510

History

Wed, 15 Jul 2026 12:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 14 Jul 2026 17:45:00 +0000

Type	Values Removed	Values Added
Description		Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.
Title		GitHub Copilot Remote Code Execution Vulnerability
First Time appeared		Microsoft Microsoft gihub Copilot Plugin For Jetbrains Ides
Weaknesses		CWE-641
CPEs		cpe:2.3:a:microsoft:gihub_copilot_plugin_for_jetbrains_ides::::::::
Vendors & Products		Microsoft Microsoft gihub Copilot Plugin For Jetbrains Ides
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50510
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-07-14T17:08:02.102Z

Updated: 2026-08-03T22:56:21.846Z

Reserved: 2026-06-04T19:00:41.292Z

Link: CVE-2026-50510

Vulnrichment

Updated: 2026-07-15T10:47:49.618Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50510", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-06-04T19:00:41.292Z", "datePublished": "2026-07-14T17:08:02.102Z", "dateUpdated": "2026-08-03T22:56:21.846Z"}, "containers": {"cna": {"title": "GitHub Copilot Remote Code Execution Vulnerability", "datePublic": "2026-07-14T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:gihub_copilot_plugin_for_jetbrains_ides:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "1.13.0-251"}]}]}], "affected": [{"vendor": "Microsoft", "product": "GitHub Copilot Plugin for JetBrains IDEs", "versions": [{"version": "1.0.0", "lessThan": "1.13.0-251", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-641: Improper Restriction of Names for Files and Other Resources", "lang": "en-US", "type": "CWE", "cweId": "CWE-641"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-08-03T22:56:21.846Z"}, "references": [{"name": "GitHub Copilot Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50510"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T03:58:32.778830Z", "id": "CVE-2026-50510", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T10:47:54.216Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50510", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-15T03:58:32.778830Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T10:47:49.618Z"}}], "cna": {"title": "GitHub Copilot Remote Code Execution Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "GitHub Copilot Plugin for JetBrains IDEs", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.13.0-251", "versionType": "custom"}]}], "datePublic": "2026-07-14T14:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50510", "name": "GitHub Copilot Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-641", "description": "CWE-641: Improper Restriction of Names for Files and Other Resources"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:gihub_copilot_plugin_for_jetbrains_ides:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.13.0-251", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-08-03T22:56:21.846Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50510", "state": "PUBLISHED", "dateUpdated": "2026-08-03T22:56:21.846Z", "dateReserved": "2026-06-04T19:00:41.292Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-07-14T17:08:02.102Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}