CVE-2026-41109
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker…
Published May 12, 2026 · updated Aug 10, 2026 · microsoft visual studio code
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 12, 2026 · NIST NVD
Detected
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
Aug 10, 2026 · NIST NVD
Updated
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
Affected
- cpe microsoft/visual studio codeversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-41109
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41109
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
nvd.nist.gov