CVE-2025-66389

Analyzed Analyzed - Analysis Complete

GitHub Copilot 1.372.0 Unauthorized Filesystem Access via URI Parameter

Publication date: 2026-06-22

Last updated on: 2026-06-30

Assigner: MITRE

Description

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-22

Last Modified

2026-06-30

Generated

2026-07-12

AI Q&A

2026-06-23

EPSS Evaluated

2026-07-11

NVD

CVE-2025-66389

EUVD

EUVD-2025-210298

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	github_copilot	1.372.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-552	The product makes files or directories accessible to unauthorized actors, even though they should not be.

Attack-Flow Graph

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on a network or system.

Mitigation Strategies

The provided resources do not specify immediate mitigation steps for this vulnerability.

Executive Summary

The vulnerability in GitHub Copilot version 1.372.0 allows unauthorized filesystem access outside of the designated workspace folder. This occurs through a file-handler URI parameter used by the fetch_webpage tool, which can be exploited without user approval.

If an attacker uses indirect prompt injection, they could leverage this vulnerability to exfiltrate files from the user's system.

Impact Analysis

This vulnerability can lead to unauthorized access and exfiltration of files from your filesystem outside the intended workspace. An attacker exploiting this flaw could potentially read sensitive files without your consent.

Such unauthorized access could compromise your data privacy and security, potentially exposing confidential information.

Compliance Impact

The provided context and resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2025-66389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70