The advisory was published on August 21, 2026. Microsoft assigns the issue a CVSS base score of 7.8 and a temporal score of 6.8, with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. The score reflects a local attack that requires user interaction, but no attacker authentication, and that can affect confidentiality, integrity, and availability in the signed-in user’s security context.
Microsoft’s status fields are direct: Publicly disclosed: No. Exploited: No. Customer action required: Yes. Microsoft’s exploitation assessment is Exploitation More Likely.
Malicious instructions can arrive through ordinary development content
Microsoft classifies CVE-2026-70335 as CWE-78, improper neutralization of special elements used in an OS command, commonly called OS command injection. Its description states: “Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.”
The key attack condition is content processed by the AI agent, rather than a conventional malicious executable that a victim deliberately installs. Microsoft says an attacker could embed malicious instructions in a web page, repository file, or tool response. If a user then runs the agent against that content, those instructions could cause the agent to run commands locally without asking the user to confirm them.
That mechanism is consequential for developers and administrators using agent-assisted coding workflows. Repositories, code samples, issue-linked documentation, generated tool output, and web material can all become inputs to an agent’s context. The advisory does not describe a remote network takeover: the attack is carried out locally and requires a user to run the agent against the attacker-controlled content. But an attacker needs no authentication to publish or otherwise supply that content.
Microsoft says successful exploitation could permit code execution in the context of the user signed in to Visual Studio Code. In practical terms, the resulting permissions are tied to that user’s local rights. A developer working under an account with access to source trees, credentials, deployment tooling, or administrative functions presents a materially different exposure from a locked-down standard account, even though the CVE’s stated impact remains execution in the signed-in user context.
Visual Studio Code 1.132.1 is the fixed build
The affected product in Microsoft’s record is Visual Studio Code. The KB-to-build mapping identifies a fixed build of 1.132.1 and has an empty KB field. Microsoft’s remediation value is explicit: “For Visual Studio Code, update to fixed build 1.132.1 or later.”
This is a build-based remediation, not an operating-system cumulative update workflow. IT teams should therefore verify the actual installed Visual Studio Code version across managed endpoints and bring installations to build 1.132.1 or later. The issue concerns GitHub Copilot and Visual Studio Code behavior described in Microsoft’s advisory, so organizations should treat version verification as a developer-tool maintenance task rather than waiting for a Windows update cycle.
Microsoft’s advisory provides no alternative mitigation in the supplied record. The supported corrective action is the update. Teams that use managed software deployment should make the fixed Visual Studio Code build available promptly, then confirm that devices have moved beyond vulnerable builds rather than only confirming that an update job was offered.
For individual users, the meaningful check is equally direct: ensure Visual Studio Code is updated to fixed build 1.132.1 or later before relying on agent workflows that process untrusted or externally obtained material. The advisory’s description specifically identifies content from web pages, repository files, and tool responses as possible delivery channels for malicious instructions.
What the CVSS vector says about the threat model
The CVSS vector is local attack vector (AV:L) and low attack complexity (AC:L), with no attacker privileges required (PR:N) and user interaction required (UI:R). It also records unchanged scope (S:U) and high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H).
Those fields align with Microsoft’s explanation of the attack path. The attacker does not have to log on to the victim’s machine or authenticate to a target service. Instead, the attacker must get crafted instructions into content an AI agent will process, then rely on a user to run that agent against the content. The unsafe outcome occurs when injected instructions lead to command execution without a confirmation prompt.
The temporal portion of the vector records unproven exploit code maturity (E:U), an official remediation level (RL:O), and confirmed report confidence (RC:C). Microsoft has also marked the issue as not exploited, while assessing exploitation as more likely. For defenders, those are distinct facts: the advisory records no exploitation at publication, but does not support treating the issue as low-priority simply because it is local and interaction is required.
The CVE’s severity is Important, and the 7.8 base score places it among issues that deserve active remediation in environments where Visual Studio Code and AI-assisted coding are used on valuable development workstations. A local attack can still expose repository contents, alter files, or disrupt a workstation when command execution occurs with the permissions of the user who launched the agent.
Customer action is an update, followed by deployment verification
Microsoft’s official advisory labels the issue “GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability.” Its stated exploitation scenario is unusually specific: hostile instructions are embedded in content, processed by an AI agent, and then translated into commands that execute on the user’s machine without a confirmation request.
That makes the update particularly relevant to organizations that treat repositories and developer tools as trusted internal infrastructure while allowing developers to work with public repositories, third-party dependencies, web documentation, or external tool results. The advisory does not say that every repository file or tool response is dangerous; it says those are examples of content through which an attacker could supply the malicious instructions.
Administrators should prioritize the update for endpoints where users invoke GitHub Copilot or related agent capabilities against material outside their direct control. They should also verify that deployment reporting identifies the Visual Studio Code 1.132.1 fixed build, because Microsoft’s remediation is tied to that build threshold rather than to a named KB package.
The immediate operational consequence is straightforward: update Visual Studio Code to fixed build 1.132.1 or later, then confirm the installed build on systems that use AI-agent workflows.