CVE-2026-83953: GitHub Copilot for Jetbrains Information Disclosure Vulnerability

Q: Who can exploit this issue?

An attacker must be authorized and have local access. The available data does not indicate that unauthenticated or remote attackers can exploit it.

Q: What is the security impact?

Successful exploitation can disclose information locally. The provided severity vector indicates high confidentiality impact, with no integrity or availability impact.

Q: Is user interaction required?

No. The severity vector indicates that user interaction is not required.

Q: Which configurations or plugin versions are affected?

The available data identifies the Microsoft GitHub Copilot Plugin for JetBrains IDEs but does not provide affected versions, fixed versions, or configuration-specific conditions.

Published Nov 10, 2026

Updated

GitHub Copilot for Jetbrains Information Disclosure Vulnerability

Other sources

Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an authorized attacker to disclose information locally.

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft GitHub Copilot Plugin for JetBrains IDEs<1.17.0-251

1.17.0-251

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.17.0-251Patch KB1163583

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

DescriptionSeverity

Data Sourced

via NVD·07:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authorized and have local access. The available data does not indicate that unauthenticated or remote attackers can exploit it.

What is the security impact?

Successful exploitation can disclose information locally. The provided severity vector indicates high confidentiality impact, with no integrity or availability impact.

Is user interaction required?

No. The severity vector indicates that user interaction is not required.

Which configurations or plugin versions are affected?

The available data identifies the Microsoft GitHub Copilot Plugin for JetBrains IDEs but does not provide affected versions, fixed versions, or configuration-specific conditions.

CVE-2026-83953: GitHub Copilot for Jetbrains Information Disclosure Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the security impact?

Is user interaction required?

Which configurations or plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the security impact?

Is user interaction required?

Which configurations or plugin versions are affected?