CVE-2026-83953mediumData leakage2026-11-10
CVE-2026-83953: GitHub Copilot plugin for JetBrains IDEs has a command injection that can read local files, fixed in 1.17.0-251
Microsoft's November 2026 update fixes a command injection (CWE-77) in the GitHub Copilot plugin for JetBrains IDEs that lets an authorized local attacker read files from the file system. Microsoft says customer action is required: update the plugin to 1.17.0-251 or later.
What it is
MSRC titles it 'GitHub Copilot for Jetbrains Information Disclosure Vulnerability': improper neutralization of special elements in a command allows an authorized attacker to disclose information locally.
Microsoft's FAQ says the information that could be disclosed is unauthorized file system access, meaning reading from the file system.
MSRC lists it as not publicly disclosed and not exploited. The fixed build is 1.17.0-251 of the JetBrains plugin.
How to check
- In your JetBrains IDE, open Settings, then Plugins, then Installed, and check the GitHub Copilot plugin version.
How to fix
- Update the GitHub Copilot plugin to 1.17.0-251 or later and restart the IDE.
Sources
More advisories for this tool