CVE-2025-64660

—

CVSS 3.1

8.0 high

EPSS

<1%p45

Published

Nov 20, 2025 (Nov 20, 2025)

Modified

Jun 17, 2026

Description

Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.

Vendors: microsoft
Products: visual studio code
Weakness: CWE-284
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news1 stories

Researcher Uncovers 30+ Flaws in AI Coding Tools Enabling Data Theft and RCE Attacks

The Hacker NewsDec 15, 00:00 UTC · Dec 15, 2025Vulnerability CVE-2025-49150 CVE-2025-53097 CVE-2025-58335+8 CVEs1

47