# CVE-2026-21523: TOCTOU Race Condition in GitHub Copilot / Visual Studio Enables Authorized Network Code Execution

> Microsoft disclosed CVE-2026-21523, a time-of-check time-of-use (TOCTOU) race condition (CWE-367) in GitHub Copilot and Visual Studio / VS Code. An authorized attacker who can win the race between when the IDE validates a suggestion or resource and when it applies it can execute code over the network. CVSS 8.0 HIGH (AV:N/AC:L/PR:L/UI:R). An official fix is available; exploit maturity is Unproven (E:U) with no public PoC and no confirmed in-the-wild exploitation.

- **Published:** 2026-05-29T00:00:00Z
- **Last reviewed:** 2026-05-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0627
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-copilot-toctou-race-flaw-tl-2026-0627.webp?v=243c3784 (Threadlinqs threat intel: CVE-2026-21523 GitHub Copilot TOCTOU: Detection & IOCs (TL-2026-0627) — High severity, 13 IOCs, 9 detection rules.)
- **ID:** TL-2026-0627
- **Severity:** HIGH (CVSS 8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 13
- **CVEs:** CVE-2026-21523

## Description

CVE-2026-21523 is a time-of-check time-of-use (TOCTOU) race condition, classified CWE-367, affecting GitHub Copilot and its Visual Studio / Visual Studio Code integration (the GitHub Copilot Chat extension). Microsoft (secure@microsoft.com) published the advisory on 2026-02-10; NVD reached 'Analyzed' status on 2026-02-11. The flaw arises from a window between the moment the IDE/Copilot validates a file, suggestion, or resource (the 'check') and the moment that resource is actually consumed or applied (the 'use'). An attacker able to manipulate the underlying resource during that window — for example by swapping a validated file or symlink for a malicious one — can cause the validated-but-substituted content to be acted upon, leading to code execution.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (base 8.0, HIGH) describes the exploitation profile precisely: the attack is reachable over a network (AV:N) with low complexity (AC:L), but requires the attacker to already hold some authorization (PR:L) and requires a victim interaction such as accepting or applying a Copilot suggestion (UI:R). Successful exploitation yields high impact to confidentiality, integrity, and availability within an unchanged scope. Because the vulnerable component sits inside the developer workflow, the practical consequence extends beyond a single host: tampering with code that is generated, validated, or applied inside the IDE can corrupt build artifacts and undermine software-supply-chain and build integrity. Third-party analysis frames the risk around AI-output validation and the trust placed in Copilot-applied edits.

Exploit maturity is the most important qualifier for this entry. The authoritative record carries temporal metrics E:U/RL:O/RC:C — Unproven exploit code, Official remediation available, Confirmed report. As of this analysis (2026-05-29) there is no public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is NOT listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor, malware family, or command-and-control infrastructure is associated with this vulnerability; the MITRE ATT&CK mappings below are analytically derived from the vulnerability class and attack profile rather than from observed intrusions.

Remediation is straightforward: Microsoft shipped fixed builds and recommends updating to the patched versions. Affected ranges per the CVE record are GitHub Copilot Chat extension 0.27.0 before 0.37.1 and the Visual Studio / VS Code line 1.0.0 before 1.110.1. Note a source variance worth tracking: the NVD CPE configuration lists cpe:2.3:a:microsoft:visual_studio_code with versionEndExcluding 1.109.2, which differs slightly from the MSRC-derived fixed version 1.110.1; defenders should treat the higher fixed version as authoritative and confirm against the MSRC advisory for their specific product line.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1083 File and Directory Discovery
- T1565 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Workspace Config TOCTOU Swap Candidate — Exploitation Phase (SPL)** (`TL-2026-0627-SPL-001`)

Detects the CVE-2026-21523 check->use window: a .vscode workspace configuration file (tasks.json/settings.json/launch.json) rewritten or replaced repeatedly within a short window, the file-substitution race an authorized attacker uses to get validated-but-swapped content applied by GitHub Copilot / VS Code.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1565.001, T1574
- **Data sources:** sysmon, linux_sysmon, mde_deviceFileEvents
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=11 OR EventCode=2 OR EventCode=23 OR EventCode=26)
(TargetFilename="*\\.vscode\\tasks.json" OR TargetFilename="*\\.vscode\\settings.json" OR TargetFilename="*\\.vscode\\launch.json")
```CVE-2026-21523 check->use window: a workspace config rewritten >=3x in a 10s window is a TOCTOU substitution candidate```
| bin _time span=10s
| stats count AS change_events dc(ProcessGuid) AS distinct_writers values(Image) AS writer_images values(EventCode) AS event_codes min(_time) AS first_seen max(_time) AS last_seen by Computer, User, TargetFilename, _time
| where change_events>=3
| eval window_secs=last_seen-first_seen
| table _time Computer User TargetFilename change_events distinct_writers writer_images event_codes window_secs
````

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName in~ ("tasks.json","settings.json","launch.json")
| where FolderPath has ".vscode"
| where ActionType in ("FileCreated","FileModified","FileRenamed","FileDeleted")
// CVE-2026-21523 TOCTOU: rapid repeated rewrite of the same workspace config = check->use swap candidate
| summarize ChangeEvents=count(), DistinctWriters=dcount(InitiatingProcessId), Writers=make_set(InitiatingProcessFileName,8), Actions=make_set(ActionType), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, FolderPath, FileName, bin(Timestamp,10s)
| where ChangeEvents >= 3
| extend WindowMs = datetime_diff('millisecond', LastSeen, FirstSeen)
| project Timestamp=FirstSeen, DeviceName, FolderPath, FileName, ChangeEvents, DistinctWriters, Writers, Actions, WindowMs
```

### Sigma

```yaml
title: VS Code Workspace Config Rapidly Rewritten - TOCTOU Swap Candidate (CVE-2026-21523)
id: e1432290-9bbb-4b1f-882b-9631e0409a92
status: experimental
description: Detects rapid repeated modification or replacement of .vscode workspace configuration files (tasks.json/settings.json/launch.json), the check->use substitution pattern abused by the CVE-2026-21523 TOCTOU race condition (CWE-367) in GitHub Copilot / Visual Studio Code.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523
    - https://nvd.nist.gov/vuln/detail/CVE-2026-21523
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/05/29
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1203
    - attack.t1565.001
    - attack.t1574
    - cve.2026.21523
logsource:
    category: file_event
detection:
    selection:
        TargetFilename|endswith:
            - '\.vscode\tasks.json'
            - '\.vscode\settings.json'
            - '\.vscode\launch.json'
            - '/.vscode/tasks.json'
            - '/.vscode/settings.json'
            - '/.vscode/launch.json'
    timeframe: 10s
    condition: selection | count() by TargetFilename >= 3
falsepositives:
    - Formatter or extension auto-write of workspace config files
    - Source control checkout/branch switch rewriting workspace settings
    - Bulk initial workspace scaffolding
level: high
```

**Known false positives:**

- Formatters or extensions auto-writing workspace config files
- Source control checkout or branch switch rewriting .vscode settings
- Bulk initial workspace scaffolding

**Tuning notes:** Tune the change_events threshold (default >=3 in 10s) per environment baseline. Exclude known formatter/extension writer images and CI provisioning accounts. Tighten the window to <=2s to focus on true check->use races once a baseline is established.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Workspace Config TOCTOU Swap Candidate — Exploitation Phase (KQL) (locked: unlock with TL Creds)
- IDE Host Spawns Command Interpreter After Apply — Post-Exploitation Phase (KQL) (locked: unlock with TL Creds)
- Workspace Config Substituted by Non-IDE Process — C2/Lateral & Hijack Phase (KQL) (locked: unlock with TL Creds)
- Workspace Config TOCTOU Swap Candidate — Exploitation Phase (SIG) (locked: unlock with TL Creds)
- IDE Host Spawns Command Interpreter After Apply — Post-Exploitation Phase (SIG) (locked: unlock with TL Creds)
- Workspace Config Substituted by Non-IDE Process — C2/Lateral & Hijack Phase (SIG) (locked: unlock with TL Creds)
- IDE Host Spawns Command Interpreter After Apply — Post-Exploitation Phase (SPL) (locked: unlock with TL Creds)
- Workspace Config Substituted by Non-IDE Process — C2/Lateral & Hijack Phase (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [MSRC Update Guide — CVE-2026-21523](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523)
- [NVD — CVE-2026-21523](https://nvd.nist.gov/vuln/detail/CVE-2026-21523)
- [CVE-2026-21523 — CVEdetails](https://www.cvedetails.com/cve/CVE-2026-21523)
- [CVE-2026-21523 — THREATINT](https://cve.threatint.eu/CVE/CVE-2026-21523)
- [CVE-2026-21523: Immediate Patch and Hardening Guide for Copilot and VS Code](https://windowsforum.com/threads/cve-2026-21523-immediate-patch-and-hardening-guide-for-copilot-and-vs-code.400783/)
- [VS Code Copilot Co-Author: When AI Attribution Becomes a Supply Chain Trust Problem](https://www.penligent.ai/hackinglabs/vs-code-copilot-co-author-when-ai-attribution-becomes-a-supply-chain-trust-problem/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0627