AI developer toolsBriefConfirmed by two or more outlets
GitHub Copilot 2026
CVE-2026-29783: Copilot CLI shell-expansion RCE.
- Disclosed
What happened
- CVE-2026-29783: Copilot CLI shell-expansion RCE. Fixed in 0.0.423 (GHSA-g8r9-g2v8-jv6f).
- CVE-2026-21516: Copilot for JetBrains command injection. Fixed in 1.5.63, Feb 2026.
- RoguePilot (Orca).
- CVE-2026-70335: VS Code / Copilot privilege escalation, fixed in VS Code 1.132.1 (secondary only).
- Adversa’s “cryptographic context injection” against Copilot CLI autopilot (Oct 2026): GitHub declined it as a vulnerability.
Live scores
Live scores
CVE-2026-21516- EPSS
- 0.009
low predicted chance of attack - VEDAS
- 0.048
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-29783- EPSS
- 0.005
low predicted chance of attack - VEDAS
- 0.043
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-70335- EPSS
- 0.005
low predicted chance of attack - VEDAS
- 0.046
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Sources
- https://github.com/advisories/GHSA-g8r9-g2v8-jv6f
- https://orca.security/resources/blog/roguepilot-github-copilot-vulnerability/
- https://adversa.ai/blog/cryptographic-context-injection-github-copilot/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.