CVE-2026-21523: TOCTOU Race Condition in GitHub Copilot / Visual Studio Enables Authorized Network Code Execution
CVE-2026-21523 (TL-2026-0627) is a high-severity software vulnerability scored CVSS 8, first published 2026-05-29. It has no confirmed attribution, affects Microsoft / GitHub GitHub Copilot Chat extension (VS Code / Visual, references 1 CVE (CVE-2026-21523), maps to 7 MITRE ATT&CK techniques (T1036, T1059, T1083), and is covered by 9 detection rules and 13 indicators of compromise.
Key facts for TL-2026-0627
- Threat ID
- TL-2026-0627
- Severity
- HIGH
- CVSS
- 8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-05-29
- Last reviewed
- 2026-05-29
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, devops, open-source
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in CVE-2026-21523
Malware and tooling: Visual Studio, Visual Studio Code
Microsoft disclosed CVE-2026-21523, a time-of-check time-of-use (TOCTOU) race condition (CWE-367) in GitHub Copilot and Visual Studio / VS Code. An authorized attacker who can win the race between when the IDE validates a suggestion or resource and when it applies it can execute code over the network. CVSS 8.0 HIGH (AV:N/AC:L/PR:L/UI:R). An official fix is available; exploit maturity is Unproven (E:U) with no public PoC and no confirmed in-the-wild exploitation.
How CVE-2026-21523 works
CVE-2026-21523 is a time-of-check time-of-use (TOCTOU) race condition, classified CWE-367, affecting GitHub Copilot and its Visual Studio / Visual Studio Code integration (the GitHub Copilot Chat extension). Microsoft (secure@microsoft.com) published the advisory on 2026-02-10; NVD reached 'Analyzed' status on 2026-02-11. The flaw arises from a window between the moment the IDE/Copilot validates a file, suggestion, or resource (the 'check') and the moment that resource is actually consumed or applied (the 'use'). An attacker able to manipulate the underlying resource during that window — for example by swapping a validated file or symlink for a malicious one — can cause the validated-but-substituted content to be acted upon, leading to code execution.
The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (base 8.0, HIGH) describes the exploitation profile precisely: the attack is reachable over a network (AV:N) with low complexity (AC:L), but requires the attacker to already hold some authorization (PR:L) and requires a victim interaction such as accepting or applying a Copilot suggestion (UI:R). Successful exploitation yields high impact to confidentiality, integrity, and availability within an unchanged scope. Because the vulnerable component sits inside the developer workflow, the practical consequence extends beyond a single host: tampering with code that is generated, validated, or applied inside the IDE can corrupt build artifacts and undermine software-supply-chain and build integrity. Third-party analysis frames the risk around AI-output validation and the trust placed in Copilot-applied edits.
Exploit maturity is the most important qualifier for this entry. The authoritative record carries temporal metrics E:U/RL:O/RC:C — Unproven exploit code, Official remediation available, Confirmed report. As of this analysis (2026-05-29) there is no public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is NOT listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor, malware family, or command-and-control infrastructure is associated with this vulnerability; the MITRE ATT&CK mappings below are analytically derived from the vulnerability class and attack profile rather than from observed intrusions.
Remediation is straightforward: Microsoft shipped fixed builds and recommends updating to the patched versions. Affected ranges per the CVE record are GitHub Copilot Chat extension 0.27.0 before 0.37.1 and the Visual Studio / VS Code line 1.0.0 before 1.110.1. Note a source variance worth tracking: the NVD CPE configuration lists cpe:2.3:a:microsoft:visual_studio_code with versionEndExcluding 1.109.2, which differs slightly from the MSRC-derived fixed version 1.110.1; defenders should treat the higher fixed version as authoritative and confirm against the MSRC advisory for their specific product line.
MITRE ATT&CK techniques used in TL-2026-0627
Defense Evasion
T1036 Masquerading; T1574 Hijack Execution Flow
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Discovery
T1083 File and Directory Discovery
Initial Access
Impact
Affected products and versions in CVE-2026-21523
- Microsoft / GitHub — GitHub Copilot Chat extension (VS Code / Visual Studio)
Vulnerable versions: 0.27.0 before 0.37.1
Fixed in: 0.37.1 - Microsoft — Visual Studio / Visual Studio Code (Copilot integration)
Vulnerable versions: 1.0.0 before 1.110.1
Fixed in: 1.110.1
Remediation for CVE-2026-21523
Patches
- GitHub Copilot Chat extension >= 0.37.1
- Visual Studio / VS Code Copilot integration >= 1.110.1 (MSRC). NVD CPE notes VS Code fixed at >= 1.109.2 — treat 1.110.1 as authoritative and confirm against MSRC for the specific product.
- Apply the official fix referenced in MSRC advisory CVE-2026-21523.
Immediate actions
- Update the GitHub Copilot Chat extension to 0.37.1 or later (0.x line) and the Visual Studio / VS Code Copilot integration to 1.110.1 or later, per the MSRC advisory.
- Restart Visual Studio / VS Code after updating and verify the installed extension version (Extensions pane -> GitHub Copilot Chat -> version).
- Until patched, review and manually confirm Copilot-suggested edits before applying, and avoid auto-apply of multi-file changes.
Workarounds
- Disable or limit Copilot auto-apply of edits and require manual review of suggestions.
- Constrain IDE network egress to trusted endpoints.
- Operate development workspaces on trusted, non-shared filesystems to reduce the attacker's ability to race a resource swap.
Longer-term hardening
- Enable automatic updates for VS Code extensions and enforce a minimum-version policy for AI coding assistants via organizational settings.
- Apply file integrity monitoring to workspace .vscode configuration files (settings.json, tasks.json, launch.json) and to extension install directories.
- Restrict which marketplace extensions may be installed using allowlists / extension governance policy.
- Apply least privilege to developer environments and add network egress controls so IDE processes cannot make unexpected outbound connections.
CVEs associated with CVE-2026-21523
Weaknesses (CWE) in CVE-2026-21523
CWE-367
Timeline of CVE-2026-21523
- NVD created the CVE-2026-21523 record with CVSS 3.1 base score 8.0 (HIGH) and CWE-367.
- Fixed builds released: GitHub Copilot Chat extension 0.37.1 and Visual Studio / VS Code Copilot integration 1.110.1.
- Microsoft (secure@microsoft.com) published CVE-2026-21523 via the MSRC Update Guide with an official fix available (RL:O).
- Independent hardening and analysis guidance published (WindowsForum patch guide; Penligent supply-chain/AI-attribution analysis).
- NVD completed analysis (vulnStatus 'Analyzed'); CPE configuration added for microsoft:visual_studio_code versionEndExcluding 1.109.2.
- As of 2026-05-29, CVE-2026-21523 (TOCTOU in GitHub Copilot/VS Code, CVSS 8.0) is PATCHED: Microsoft shipped an official fix on 2026-02-10 (Copilot Chat >=0.37.1, VS Code >=1.110.1). Exploit maturity stays Unproven, no public PoC, not in CISA KEV, and no in-the-wild exploitation or actor attribution found.
- As of this analysis: exploit maturity remains Unproven (E:U); no public PoC identified; not listed in CISA KEV; no confirmed in-the-wild exploitation or threat-actor attribution.
Sources cited for CVE-2026-21523
Threats related to CVE-2026-21523
- Angular Language Service VS Code Extension (Angular.ng-template) Multiple RCE Vulnerabilities — GHSA-ccq4-xmxr-8hcq
- Prompt Injection in AWS Kiro Leads to Remote Code Execution via Unprotected MCP Config (mcp.json)
- "LegacyHive" Windows User Profile Service Zero-Day Allows Non-Admin Registry Hive Hijacking
- Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Detection coverage for TL-2026-0627
As of 2026-05-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0627 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.