GitHub Copilot at a glance
February 2026 Patch Tuesday fixed five GitHub Copilot vulnerabilities, including three remote code execution bugs, in VS Code with Copilot Chat, Visual Studio, and the JetBrains plugin. Microsoft rated all Important (CVSS 8.0 to 8.8) and reported none as exploited or public.
GitHub Copilot: status
- Affected
- Visual Studio Code and the GitHub Copilot Chat extension before the February 2026 updates (Microsoft lists VS Code 1.110.1 and Copilot Chat 0.37.1)
- Visual Studio 2022 17.14 before 17.14.26 and Visual Studio 2026 18.3 before 18.3.0
- GitHub Copilot plugin for JetBrains IDEs before 1.5.63
- CVE identifiers
- Status as of
- Discovered by
- Several external researchers credited by Microsoft, including Trend's Zero Day Initiative, 360 VRI, and 1seal
What changed with GitHub Copilot
On February 10, 2026, Microsoft's monthly security release included five GitHub Copilot flaws: remote code execution in Copilot with VS Code (CVE-2026-21523, a time-of-check race), in Copilot with Visual Studio (CVE-2026-21256, command injection), and in the Copilot plugin for JetBrains IDEs (CVE-2026-21516, command injection), plus a security feature bypass in Copilot with VS Code (CVE-2026-21518) and an elevation of privilege in Copilot with Visual Studio (CVE-2026-21257).
Microsoft rated all five Important, with CVSS 3.1 scores from 8.0 to 8.8, and marked them not publicly disclosed and not exploited at release. Its listed updates are Visual Studio Code 1.110.1 with Copilot Chat extension 0.37.1, Visual Studio 2022 17.14.26 and Visual Studio 2026 18.3.0, and Copilot for JetBrains 1.5.63. Researchers credited include teams from Trend's Zero Day Initiative and 360 VRI, among others.
How to fix it: GitHub Copilot
1. Update
Update Visual Studio Code to 1.110.1 or later and the GitHub Copilot Chat extension to 0.37.1 or later.
msrc.microsoft.com (opens in a new tab)2. Update
Update Visual Studio 2022 to 17.14.26 or Visual Studio 2026 to 18.3.0 or later.
msrc.microsoft.com (opens in a new tab)3. Update
Update the GitHub Copilot plugin for JetBrains IDEs to 1.5.63 or later.
msrc.microsoft.com (opens in a new tab)
Advisories
- MSRC CVE-2026-21523 (opens in a new tab)msrc.microsoft.com
- MSRC CVE-2026-21256 (opens in a new tab)msrc.microsoft.com
- MSRC CVE-2026-21516 (opens in a new tab)msrc.microsoft.com
- MSRC CVE-2026-21518 (opens in a new tab)msrc.microsoft.com
- MSRC CVE-2026-21257 (opens in a new tab)msrc.microsoft.com
Why GitHub Copilot matters for businesses
Coding assistants now run commands and edit files, so their bugs land in the same class as IDE remote code execution. Companies that let developers use Copilot should push editor and extension updates as fast as browser updates, and check that auto-update is on for VS Code extensions and JetBrains plugins.
Sources for this story
- February 2026 Security Updates (CVRF) (opens in a new tab)Official
Microsoft Security Response Center · api.msrc.microsoft.com
- CVE-2026-21523 GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability (opens in a new tab)Official
Microsoft Security Response Center · msrc.microsoft.com
- CVE-2026-21256 GitHub Copilot and Visual Studio Remote Code Execution Vulnerability (opens in a new tab)Official
Microsoft Security Response Center · msrc.microsoft.com
- CVE-2026-21256 Detail (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
- CVE-2026-21523 Detail (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #patch-tuesday
- #ai-coding-agents
- #github-copilot
- #visual-studio-code
