CVE-2026-70335: Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual
highvulnerabilityLLM-Specific
security
Summary
CVE-2026-70335 is a vulnerability in GitHub Copilot and Visual Studio Code that allows improper neutralization of special elements in OS commands (OS command injection, where an attacker can execute arbitrary system commands). An unauthorized attacker could exploit this to elevate their privileges locally on an affected system.
Vulnerability Details
CVSS Score
7.8(high)
EPSS (30-day exploit probability)
EPSS: 0.0%
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
local
Attack Complexity
low
Privileges Required
none
User Interaction
required
Disclosure Date
August 11, 2026
Classification
Attack Type
Other
Attack SophisticationModerate
Impact (CIA+S)
integrityconfidentiality
Affected Vendors
Microsoft
Related Issues
Monthly digest — independent AI security research
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-70335
First tracked: August 11, 2026 at 02:09 PM
Classified by LLM (prompt v3) · confidence: 85%