CVE-2026-24301: Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unaut

CVE-2026-24301 is a command injection vulnerability (a weakness where an attacker hides malicious commands in user input to trick a program into executing them) in Microsoft Copilot that allows an unauthorized attacker to access and steal information over a network. The vulnerability stems from improper neutralization of special elements used in commands. The CVSS severity score (a 0-10 rating of how dangerous a vulnerability is) has not yet been assigned by NIST.