{"data":{"id":"d7c5513e-0ce8-476b-a186-63b8c5c32b3e","title":"CVE-2026-70335: Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual…","summary":"CVE-2026-70335 is an OS command injection flaw (CWE-78) in GitHub Copilot and Visual Studio Code. The source says an unauthorized attacker can elevate privileges locally. NVD has not yet provided an assessment, and Microsoft Corporation is listed as the source.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70335","publishedAt":"2026-08-11T17:19:11.153Z","cveId":"CVE-2026-70335","cweIds":["CWE-78"],"cvssScore":"7.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Microsoft"],"affectedVendorsRaw":["GitHub Copilot","Visual Studio Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"local","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00462,"epssCheckedAt":"2026-11-13T12:06:19.524Z","kevDateAdded":null,"advisoryAliases":["GHSA-hj52-q5wj-vpwg"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T06:14:09.279Z","patchAvailable":null,"disclosureDate":"2026-08-11T17:19:11.153Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}