CVE-2025-66389
Received Received - Intake
GitHub Copilot 1.372.0 Unauthorized Filesystem Access via URI Parameter

Publication date: 2026-06-22

Last updated on: 2026-06-22

Assigner: MITRE

Description
GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-22
Last Modified
2026-06-22
Generated
2026-06-22
AI Q&A
2026-06-22
EPSS Evaluated
N/A
NVD
CVE-2025-66389
EUVD
EUVD-2025-210298
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
microsoft github_copilot 1.372.0
microsoft visual_studio_code *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in GitHub Copilot version 1.372.0 allows unauthorized filesystem access outside of the designated workspace folder. This occurs through a file-handler URI parameter used by the fetch_webpage tool, which can be exploited without user approval.

If an attacker uses indirect prompt injection, they could leverage this vulnerability to exfiltrate files from the user's system.

Impact Analysis

This vulnerability can lead to unauthorized access and exfiltration of files from your filesystem outside the intended workspace. An attacker exploiting this flaw could potentially read sensitive files without your consent.

Such unauthorized access could compromise your data privacy and security, potentially exposing confidential information.

Compliance Impact

The provided context and resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-66389. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart