CVE-2025-62449

MediumCVSS 6.8

Published: 11/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

39th percentile - higher than 39% of all known CVEs

Summary

The Visual Studio Code CoPilot Chat Extension contains a path traversal vulnerability due to improper limitation of a pathname to a restricted directory. An authorized attacker can locally bypass a security feature.

Risk Assessment

An attacker with local access may bypass security controls and access resources outside the intended directory, potentially leading to data disclosure or modification.

Recommendation

Update the Visual Studio Code CoPilot Chat Extension to the latest patched version.

Other vulnerabilities in Visual Studio Code CoPilot Chat Extension

CVE-2025-62222High
Improper neutralization of special elements used in a command (command injection) in the Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.

Original NVD description (English source)

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS