CVE-2026-21523: TOCTOU Race Condition in GitHub Copilot / Visual Studio Enables Authorized Network Code Execution

Key facts for Copilot TOCTOU race flaw

Detection coverage for Copilot TOCTOU race flaw

As of 2026-05-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0627 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Workspace Config TOCTOU Swap Candidate — Exploitation Phase (SPL)

Detects the CVE-2026-21523 check->use window: a .vscode workspace configuration file (tasks.json/settings.json/launch.json) rewritten or replaced repeatedly within a short window, the file-substitution race an authorized attacker uses to get validated-but-swapped content applied by GitHub Copilot / VS Code.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1565.001, T1574
• Data sources: sysmon, linux_sysmon, mde_deviceFileEvents
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=11 OR EventCode=2 OR EventCode=23 OR EventCode=26)
(TargetFilename="*\\.vscode\\tasks.json" OR TargetFilename="*\\.vscode\\settings.json" OR TargetFilename="*\\.vscode\\launch.json")
```CVE-2026-21523 check->use window: a workspace config rewritten >=3x in a 10s window is a TOCTOU substitution candidate```
| bin _time span=10s
| stats count AS change_events dc(ProcessGuid) AS distinct_writers values(Image) AS writer_images values(EventCode) AS event_codes min(_time) AS first_seen max(_time) AS last_seen by Computer, User, TargetFilename, _time
| where change_events>=3
| eval window_secs=last_seen-first_seen
| table _time Computer User TargetFilename change_events distinct_writers writer_images event_codes window_secs

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName in~ ("tasks.json","settings.json","launch.json")
| where FolderPath has ".vscode"
| where ActionType in ("FileCreated","FileModified","FileRenamed","FileDeleted")
// CVE-2026-21523 TOCTOU: rapid repeated rewrite of the same workspace config = check->use swap candidate
| summarize ChangeEvents=count(), DistinctWriters=dcount(InitiatingProcessId), Writers=make_set(InitiatingProcessFileName,8), Actions=make_set(ActionType), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, FolderPath, FileName, bin(Timestamp,10s)
| where ChangeEvents >= 3
| extend WindowMs = datetime_diff('millisecond', LastSeen, FirstSeen)
| project Timestamp=FirstSeen, DeviceName, FolderPath, FileName, ChangeEvents, DistinctWriters, Writers, Actions, WindowMs

Sigma

title: VS Code Workspace Config Rapidly Rewritten - TOCTOU Swap Candidate (CVE-2026-21523)
id: e1432290-9bbb-4b1f-882b-9631e0409a92
status: experimental
description: Detects rapid repeated modification or replacement of .vscode workspace configuration files (tasks.json/settings.json/launch.json), the check->use substitution pattern abused by the CVE-2026-21523 TOCTOU race condition (CWE-367) in GitHub Copilot / Visual Studio Code.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523
    - https://nvd.nist.gov/vuln/detail/CVE-2026-21523
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/05/29
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1203
    - attack.t1565.001
    - attack.t1574
    - cve.2026.21523
logsource:
    category: file_event
detection:
    selection:
        TargetFilename|endswith:
            - '\.vscode\tasks.json'
            - '\.vscode\settings.json'
            - '\.vscode\launch.json'
            - '/.vscode/tasks.json'
            - '/.vscode/settings.json'
            - '/.vscode/launch.json'
    timeframe: 10s
    condition: selection | count() by TargetFilename >= 3
falsepositives:
    - Formatter or extension auto-write of workspace config files
    - Source control checkout/branch switch rewriting workspace settings
    - Bulk initial workspace scaffolding
level: high

Known false positives:

• Formatters or extensions auto-writing workspace config files
• Source control checkout or branch switch rewriting .vscode settings
• Bulk initial workspace scaffolding

Tuning notes: Tune the change_events threshold (default >=3 in 10s) per environment baseline. Exclude known formatter/extension writer images and CI provisioning accounts. Tighten the window to <=2s to focus on true check->use races once a baseline is established.

• 🔒 Workspace Config TOCTOU Swap Candidate — Exploitation Phase (KQL) · unlock with TL Creds
• 🔒 IDE Host Spawns Command Interpreter After Apply — Post-Exploitation Phase (KQL) · unlock with TL Creds
• 🔒 Workspace Config Substituted by Non-IDE Process — C2/Lateral & Hijack Phase (KQL) · unlock with TL Creds
• 🔒 Workspace Config TOCTOU Swap Candidate — Exploitation Phase (SIG) · unlock with TL Creds
• 🔒 IDE Host Spawns Command Interpreter After Apply — Post-Exploitation Phase (SIG) · unlock with TL Creds
• 🔒 Workspace Config Substituted by Non-IDE Process — C2/Lateral & Hijack Phase (SIG) · unlock with TL Creds
• 🔒 IDE Host Spawns Command Interpreter After Apply — Post-Exploitation Phase (SPL) · unlock with TL Creds
• 🔒 Workspace Config Substituted by Non-IDE Process — C2/Lateral & Hijack Phase (SPL) · unlock with TL Creds

Indicators of compromise for Copilot TOCTOU race flaw

As of 2026-05-29, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-0627.

How Copilot TOCTOU race flaw works

CVSS 8.0 HIGH (AV:N/AC:L/PR:L/UI:R). An official fix is available; exploit maturity is Unproven (E:U) with no public PoC and no confirmed in-the-wild exploitation.

CVE-2026-21523 is a time-of-check time-of-use (TOCTOU) race condition, classified CWE-367, affecting GitHub Copilot and its Visual Studio / Visual Studio Code integration (the GitHub Copilot Chat extension). Microsoft (secure@microsoft.com) published the advisory on 2026-02-10; NVD reached 'Analyzed' status on 2026-02-11. The flaw arises from a window between the moment the IDE/Copilot validates a file, suggestion, or resource (the 'check') and the moment that resource is actually consumed or applied (the 'use'). An attacker able to manipulate the underlying resource during that window — for example by swapping a validated file or symlink for a malicious one — can cause the validated-but-substituted content to be acted upon, leading to code execution.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (base 8.0, HIGH) describes the exploitation profile precisely: the attack is reachable over a network (AV:N) with low complexity (AC:L), but requires the attacker to already hold some authorization (PR:L) and requires a victim interaction such as accepting or applying a Copilot suggestion (UI:R). Successful exploitation yields high impact to confidentiality, integrity, and availability within an unchanged scope. Because the vulnerable component sits inside the developer workflow, the practical consequence extends beyond a single host: tampering with code that is generated, validated, or applied inside the IDE can corrupt build artifacts and undermine software-supply-chain and build integrity. Third-party analysis frames the risk around AI-output validation and the trust placed in Copilot-applied edits.

Exploit maturity is the most important qualifier for this entry. The authoritative record carries temporal metrics E:U/RL:O/RC:C — Unproven exploit code, Official remediation available, Confirmed report. As of this analysis (2026-05-29) there is no public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is NOT listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor, malware family, or command-and-control infrastructure is associated with this vulnerability; the MITRE ATT&CK mappings below are analytically derived from the vulnerability class and attack profile rather than from observed intrusions.

Remediation is straightforward: Microsoft shipped fixed builds and recommends updating to the patched versions. Affected ranges per the CVE record are GitHub Copilot Chat extension 0.27.0 before 0.37.1 and the Visual Studio / VS Code line 1.0.0 before 1.110.1. Note a source variance worth tracking: the NVD CPE configuration lists cpe:2.3:a:microsoft:visual_studio_code with versionEndExcluding 1.109.2, which differs slightly from the MSRC-derived fixed version 1.110.1; defenders should treat the higher fixed version as authoritative and confirm against the MSRC advisory for their specific product line.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading; T1574 Hijack Execution Flow

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Discovery

T1083 File and Directory Discovery

Initial Access

T1195 Supply Chain Compromise

Impact

T1565 Data Manipulation

Remediation for Copilot TOCTOU race flaw

Patches

• GitHub Copilot Chat extension >= 0.37.1
• Visual Studio / VS Code Copilot integration >= 1.110.1 (MSRC). NVD CPE notes VS Code fixed at >= 1.109.2 — treat 1.110.1 as authoritative and confirm against MSRC for the specific product.
• Apply the official fix referenced in MSRC advisory CVE-2026-21523.

Immediate actions

• Update the GitHub Copilot Chat extension to 0.37.1 or later (0.x line) and the Visual Studio / VS Code Copilot integration to 1.110.1 or later, per the MSRC advisory.
• Restart Visual Studio / VS Code after updating and verify the installed extension version (Extensions pane -> GitHub Copilot Chat -> version).
• Until patched, review and manually confirm Copilot-suggested edits before applying, and avoid auto-apply of multi-file changes.

Workarounds

• Disable or limit Copilot auto-apply of edits and require manual review of suggestions.
• Constrain IDE network egress to trusted endpoints.
• Operate development workspaces on trusted, non-shared filesystems to reduce the attacker's ability to race a resource swap.

Longer-term hardening

• Enable automatic updates for VS Code extensions and enforce a minimum-version policy for AI coding assistants via organizational settings.
• Apply file integrity monitoring to workspace .vscode configuration files (settings.json, tasks.json, launch.json) and to extension install directories.
• Restrict which marketplace extensions may be installed using allowlists / extension governance policy.
• Apply least privilege to developer environments and add network egress controls so IDE processes cannot make unexpected outbound connections.

Affected and fixed versions

• Microsoft / GitHub — GitHub Copilot Chat extension (VS Code / Visual Studio)
  Vulnerable versions: 0.27.0 before 0.37.1
  Fixed in: 0.37.1
• Microsoft — Visual Studio / Visual Studio Code (Copilot integration)
  Vulnerable versions: 1.0.0 before 1.110.1
  Fixed in: 1.110.1

Timeline of Copilot TOCTOU race flaw

• 2026-02-10 NVD created the CVE-2026-21523 record with CVSS 3.1 base score 8.0 (HIGH) and CWE-367.
• 2026-02-10 Fixed builds released: GitHub Copilot Chat extension 0.37.1 and locked-ioc-13 / VS Code Copilot integration 1.110.1.
• 2026-02-10 Microsoft (secure@microsoft.com) published CVE-2026-21523 via the MSRC Update Guide with an official fix available (RL:O).
• 2026-02-11 Independent hardening and analysis guidance published (WindowsForum patch guide; Penligent supply-chain/AI-attribution analysis).
• 2026-02-11 NVD completed analysis (vulnStatus 'Analyzed'); CPE configuration added for microsoft:visual_studio_code versionEndExcluding 1.109.2.
• 2026-05-29 As of 2026-05-29, CVE-2026-21523 (TOCTOU in GitHub Copilot/VS Code, CVSS 8.0) is PATCHED: Microsoft shipped an official fix on 2026-02-10 (Copilot Chat >=0.37.1, VS Code >=1.110.1). Exploit maturity stays Unproven, no public PoC, not in CISA KEV, and no in-the-wild exploitation or actor attribution found.
• 2026-05-29 As of this analysis: exploit maturity remains Unproven (E:U); no public PoC identified; not listed in CISA KEV; no confirmed in-the-wild exploitation or threat-actor attribution.

Sources cited for Copilot TOCTOU race flaw

• MSRC Update Guide — CVE-2026-21523 Microsoft Security Response Center · Advisory · 2026-02-10
• NVD — CVE-2026-21523 NVD (NIST) · Advisory · 2026-02-11
• CVE-2026-21523 — CVEdetails cvedetails.com · Research · 2026-02-10
• CVE-2026-21523 — THREATINT cve.threatint.eu · Research · 2026-02-10
• CVE-2026-21523: Immediate Patch and Hardening Guide for Copilot and VS Code windowsforum.com · Blog · 2026-02-11
• VS Code Copilot Co-Author: When AI Attribution Becomes a Supply Chain Trust Problem penligent.ai · Blog · 2026-02-12

Threats related to Copilot TOCTOU race flaw

• Angular Language Service VS Code Extension (Angular.ng-template) Multiple RCE Vulnerabilities — GHSA-ccq4-xmxr-8hcq
• Prompt Injection in AWS Kiro Leads to Remote Code Execution via Unprotected MCP Config (mcp.json)
• "LegacyHive" Windows User Profile Service Zero-Day Allows Non-Admin Registry Hive Hijacking
• Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack

Previous and next in vulnerability

• Samba Printing Subsystem Remote Code Execution — CVE-2026-4480 (%J Print-Job Description Command Injection, CVSS 10.0, Unauthenticated) Previous report
• Palo Alto Networks PAN-OS / Prisma Access GlobalProtect Authentication Bypass (CVE-2026-0257) — Active Exploitation, CISA KEV Next report