HighVulnerabilityLLM-specific

CVE-2025-53773: GitHub Copilot and Visual Studio command injection allowing local code execution

Source: NVD(opens in a new tab)
Identifier: CVE-2025-53773
Published: August 12, 2025
Record updated: October 9, 2026

Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 3.3%

Summary

CVE-2025-53773 is a command injection weakness (CWE-77) in GitHub Copilot and Visual Studio. The source states that it allows an unauthorized attacker to execute code locally. NVD has not yet provided its own assessment, and the entry was published on 08/12/2025 and last modified on 08/15/2025.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Details

Scores and exploitation

CVSS score: 7.8(high)
EPSS: 3.3%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 4, 2026.

Weaknesses and techniques

Weakness (CWE): CWE-77
Attack pattern (CAPEC): CAPEC-88
AI threat technique (MITRE ATLAS): AML.T0051

Affected

Vendors: Microsoft

Classification

Attack type: Prompt injection
Attack sophistication: Moderate
AI component targeted: Plugin
Impact: Confidentiality,
Integrity
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-53773

First tracked: February 15, 2026 at 08:51 PM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 95% (self-assessed)

Topics

Coding assistants

Summary

Mitigation

Topics

Related items