Product:
Visual Studio Code CoPilot Chat Extension
Summary
Improper limitation of a pathname to a restricted directory in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally. This vulnerability can lead to unauthorized access to sensitive files. Attackers with local access can exploit this flaw to manipulate the application’s behavior.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.8 | CVE-2025-62449 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the system running the Visual Studio Code CoPilot Chat Extension. By crafting a specific pathname that traverses the restricted directory, the attacker can bypass security measures and access files that should be protected. This requires low privileges and user interaction to initiate the attack.
Affected Products
- Visual Studio Code CoPilot Chat Extension: Vulnerable to path traversal attacks allowing unauthorized file access.
Mitigation
To mitigate this vulnerability, users should ensure that they are using the latest version of the Visual Studio Code CoPilot Chat Extension. Additionally, restricting local access to the system and monitoring for unusual file access patterns can help reduce the risk of exploitation.