CVE-2026-83953

A Copilot plugin command could expose local files

Microsoft / GitHub · GitHub Copilot plugin for JetBrains IDEs

First documented disclosure · Review checkpoint

Summary

The JetBrains plugin handled command input without adequate separation. Files on the local filesystem could be read without authorization.

Severity and exploitation evidence

Medium · 5.5/10 · CVSS 3.1. Severity source.

Exploitation not established: Microsoft marked exploitation as No at publication.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The JetBrains plugin handled command input without adequate separation.

Conditions required

An authorized attacker had the local access described in Microsoft’s advisory.

Potential impact

Files on the local filesystem could be read without authorization.

Affected versions and configurations

1.0.0 through versions before 1.17.0-251, according to Microsoft.

Fix and mitigation status

1.17.0-251.

Practical next steps

Install the corrected Copilot plugin through the JetBrains Marketplace.

Operating lesson

Check the authority granted to the affected component against the operation a user expects.

Evidence and limits

The CVE record was published on 2026-11-10.

Sources