What is GHSA-7vc2-x95v-g6m9?

GHSA-7vc2-x95v-g6m9 is a security advisory published by GitHub Security Advisories with High severity. GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user...

Which CVE IDs does GHSA-7vc2-x95v-g6m9 cover?

GHSA-7vc2-x95v-g6m9 covers the following CVE IDs: CVE-2025-66389. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7vc2-x95v-g6m9?

GHSA-7vc2-x95v-g6m9 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-7vc2-x95v-g6m9HighCVSS 7.5

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user...

Vendor

GitHub Security Advisories

Published

June 22, 2026

Last Modified

June 22, 2026

🔗 CVE IDs covered (1)

CVE-2025-66389 →

📋 Description

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-66389
https://blindcyber.com/2025/10/28/copilot-fun
https://github.com/microsoft/vscode-copilot-chat
https://github.com/microsoft/vscode/blob/03baef1008086ed4960042fa463e570072173bb5/src/vs/workbench/contrib/chat/electron-browser/tools/fetchPageTool.ts#L152
https://github.com/advisories/GHSA-7vc2-x95v-g6m9