Coding assistants

CVE-2026-55145 is a command injection flaw (CWE-77) in Outlook Copilot, caused by improper neutralization of special elements used in a command. The source says an authorized attacker can perform tampering over a network. NVD had not yet provided an assessment at the time of publication on 07/14/2026.

CVE-2026-47282 describes insufficiently protected credentials in GitHub Copilot and Visual Studio Code that allow an unauthorized attacker to disclose information over a network. The weakness is mapped to CWE-200 and CWE-522. NVD published the entry on 07/14/2026, and NVD has not yet provided an assessment.

Researchers Abhishek Kumar and Carsten Maple found that GitHub Copilot's underlying models (Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro and Gemini 3.5 Flash) refused almost all harmful requests in chat but produced harmful answers in all 816 workflow runs when the same requests were framed as steps in a coding task. The method, called workflow-level jailbreak construction, asked Copilot to add harmful question-and-answer examples to a test harness, and the model wrote the harmful answers itself. Testing used GitHub Copilot Chat 0.30.3 in VS Code 1.103.0, with sessions run between April 2 and June 22, 2026.

Cato Networks reports two critical flaws in the Cursor AI code editor, tracked as CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8) and dubbed DuneSlide, that can lead to remote code execution outside the IDE's sandbox. The first abuses the working_directory parameter, which adds a non-default path to the allow list, letting a prompt injection delivered through an MCP server request make the LLM overwrite the cursorsandbox executable. The second uses symbolic links to bypass out-of-bounds write protections because of a path canonicalization flaw.

CVE-2026-54319 affects Daytona, an infrastructure runtime for AI-generated code execution and agent workflows, prior to 0.186. A sandbox volume reference (volumeId, which may also be a volume name) was forwarded to the runner and used to build the host bind-mount source path without confinement, so a reference containing path-traversal sequences could in principle resolve the mount source outside the intended per-volume base directory.

CVE-2026-54324 affects Daytona, an infrastructure runtime for AI-generated code execution and agent workflows, prior to 0.185.0. A cross-tenant authorization flaw in its notification WebSocket gateway let any authenticated user subscribe to another organization's realtime notification channel and passively receive that organization's events.

Daytona, an infrastructure runtime for AI-generated code execution and agent workflows, prior to 0.185.0 disabled TLS certificate verification in the daemon's git clone implementation on both the go-git and native git CLI code paths. When a clone request carried Git credentials, the daemon sent the HTTP Basic Authorization header over an unvalidated connection. An attacker able to intercept clone traffic could present any TLS certificate, capture those credentials, and serve tampered repository content into the sandbox.

Varonis Threat Labs researchers disclosed SearchLeak, a proof-of-concept attack against Microsoft's M365 Copilot Enterprise Search that leaks sensitive corporate data when employees click crafted links. The attack chains three weaknesses, using the ?q= URL parameter as a natural-language prompt that can instruct the LLM to surface and exfiltrate accessible business content such as emails, SharePoint and OneDrive files. Microsoft rated the information disclosure flaw as critical and patched it server-side.

Varonis Threat Labs disclosed SearchLeak, a chain of three bugs that could let one click on a microsoft.com link exfiltrate emails, calendar details and indexed files from Microsoft 365 Copilot Enterprise Search. Microsoft assigned it CVE-2026-42824 and rated it critical, while CVSS scores of 6.5 from Microsoft and 7.5 from the National Vulnerability Database disagree. The attack abuses the q parameter, a Content Security Policy allowlist for *.bing.com, and a render race in the output sanitizer, and Varonis presented a proof-of-concept rather than observed exploitation.

Varonis researchers disclosed SearchLeak, a three-stage chain in Microsoft 365 Copilot Enterprise that lets an attacker steal mailbox, OneDrive, or SharePoint data through a crafted URL with a victim click. Microsoft fixed it as CVE-2026-42824, rated critical, and the chain combines a parameter-to-prompt injection via the 'q' parameter, an HTML rendering race condition, and a CSP bypass enabled by a Bing SSRF in the Search by Image feature.