CVE-2025-66389: GitHub Copilot 1.372.0 Arbitrary File Access via Prompt Injection

Technical summary

CVE-2025-66389 is an unrestricted resource access vulnerability (CWE-552) in GitHub Copilot 1.372.0 affecting the fetch_webpage handler. The vulnerability allows traversal beyond the intended workspace boundary due to insufficient validation of file-handler URI parameters. An attacker leveraging indirect prompt injection can craft prompts that cause Copilot to fetch and process files from arbitrary filesystem locations. No authentication or user interaction (beyond the normal use of Copilot) is required for exploitation, resulting in a CVSS 3.1 score of 7.5 (High severity, Network vector, with high confidentiality impact).

Business impact

This vulnerability creates a data exfiltration risk for organizations deploying GitHub Copilot in development environments. Sensitive project files, configuration data, API keys, credentials, or source code stored outside the active workspace could be read and potentially extracted if an attacker injects malicious prompts. The threat is particularly acute in scenarios where developers interact with Copilot using content from untrusted sources (e.g., code snippets from forums, pull requests, or documentation). Organizations must weigh the productivity benefits of Copilot against the need to isolate sensitive files and monitor Copilot's access patterns.

Affected systems

GitHub Copilot version 1.372.0 is affected. Organizations using this specific version in integrated development environments (IDEs) such as Visual Studio Code, Visual Studio, JetBrains IDEs, or Neovim are in scope. The vulnerability affects both individual developers and enterprise deployments. Verify your installed Copilot version against GitHub's release notes to confirm if your environment is running the vulnerable version.

Exploitability

Exploitability is moderate to high because it requires indirect prompt injection—feeding malicious instructions into Copilot via untrusted input—rather than direct attack vectors. An attacker cannot remotely trigger the vulnerability without a user actively using Copilot; however, the barrier is low. Compromised code samples, manipulated documentation, or crafted pull request comments could serve as injection vectors. The lack of user approval mechanisms for file access outside the workspace is the root enabler.

Remediation

Update GitHub Copilot to a patched version released after version 1.372.0. Consult GitHub's official release notes and security advisories to confirm the specific patched build. Additionally, implement defense-in-depth: restrict filesystem permissions for the IDE process where Copilot runs, isolate sensitive files and credentials outside developer workspaces, and educate developers about the risks of copy-pasting untrusted code into Copilot prompts.

Patch guidance

GitHub has released security updates to address this vulnerability. Upgrade GitHub Copilot through your IDE's extension manager (Visual Studio Code, Visual Studio) or JetBrains Marketplace. For enterprise environments, verify compatibility with your IDE version before rolling out updates. GitHub's official security advisory will specify the exact patched versions; consult it to confirm your target version is safe. Enable automatic updates where possible to reduce the window of exposure.

Detection guidance

Monitor IDE and Copilot logs for unusual file access patterns, particularly requests to fetch files outside the active workspace. Implement endpoint detection and response (EDR) rules to alert on unexpected file reads by IDE processes. Use code review processes to catch suspicious Copilot suggestions that reference files outside the project. Security information and event management (SIEM) can correlate access logs with Copilot interactions to identify exploitation attempts. Threat hunters should look for sequences of indirect prompt injection followed by file exfiltration attempts.

Why prioritize this

This vulnerability warrants high priority patching because it enables data exfiltration with minimal attacker effort and no user approval. The CVSS score of 7.5 reflects the high confidentiality impact and ease of exploitation via network vectors. Although the vulnerability requires prompt injection, its presence in a widely used AI coding assistant makes it a attractive target for attackers seeking to steal intellectual property, credentials, or source code from developers. Rapid patching reduces the window of risk.

Risk score, explained

The CVSS 3.1 score of 7.5 (High) reflects: Network attack vector (AV:N) due to the ability to inject prompts via untrusted content; low attack complexity (AC:L) because no special conditions or bypasses are needed; no privileges required (PR:N) and no user interaction beyond normal Copilot use (UI:N); unchanged scope (S:U); and high confidentiality impact (C:H) from unrestricted file access. Integrity and availability are not affected, making this a pure information disclosure risk. The score does not account for the indirect prompt injection requirement, which moderates practical exploitability but is assumed as part of the attack surface.

Frequently asked questions