VulnerabilityPublished 11 Nov 2025Updated 13 Feb 2026

CVE-2025-62453: Microsoft Visual Studio Code · Improper Validation of Generative AI Output

Affects Microsoft Visual Studio CodeSource CVE Database V5

Not known to be exploited · CVSS 5.0 Medium.

Data as of 26 Oct 2026, 14:05 UTC

CVSS 3.1 base score

5.0Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.4% chance of exploitation in 30 days – higher than 37% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C

Base metrics

Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Temporal metrics

Exploit Code Maturity: Unproven
Remediation Level: Official Fix
Report Confidence: Confirmed

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.
Exploit Code Maturity: Unproven: No exploit code is available, or an exploit is theoretical.
Remediation Level: Official Fix: A complete vendor solution is available. Either the vendor has issued an official patch, or an upgrade is available.
Report Confidence: Confirmed: Detailed reports exist, or functional reproduction is possible (functional exploits may provide this). Source code is available to independently verify the assertions of the research, or the author or vendor of the affected code has confirmed the presence of the vulnerability.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 11 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

cwe-693

What to do

Affected software

Product	Affected	Fixed in
Microsoft Visual Studio Code	Affected =1.0.0	Fixed in–

AI-suggested

Restrict local access to development machines running Visual Studio Code, enforcing strict access controls and endpoint security measures.
Educate developers and users about the risks of blindly accepting AI-generated code suggestions and encourage manual review before integration.
Monitor development environments for unusual activity or unauthorized code changes that could indicate exploitation attempts.
Implement application whitelisting and code signing policies to detect and prevent unauthorized code execution.
Once Microsoft releases patches or updates addressing this vulnerability, apply them promptly across all affected systems.
Consider disabling GitHub Copilot or other generative AI features temporarily in sensitive environments until the vulnerability is resolved.
Employ runtime integrity verification tools to detect unauthorized modifications in development environments.
Maintain robust audit logs of development activities to facilitate incident investigation if exploitation occurs.

Description

Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.

Impact

For European organizations, this vulnerability poses a risk primarily to the integrity of software development processes. Attackers with local access could bypass security controls, potentially injecting malicious code or altering software components undetected. This could lead to compromised software products, intellectual property theft, or introduction of backdoors. While the vulnerability does not directly affect confidentiality or availability, the integrity impact can have downstream effects on trust and compliance, especially in regulated industries such as finance, healthcare, and critical infrastructure. Organizations relying heavily on Visual Studio Code and GitHub Copilot for development are at higher risk. The requirement for local access and user interaction limits remote exploitation but does not eliminate insider threat risks or risks from compromised endpoints. Given the widespread use of Visual Studio Code in Europe, particularly in technology hubs and enterprises, the vulnerability could have broad implications if exploited.

CWE-1426Improper Validation of Generative AI Output (opens in a new tab)
Base weakness
The product invokes a generative AI/ML component whose behaviors and outputs cannot be directly controlled, but the product does not validate or insufficiently validates the outputs to ensure that they align with the intended security, content, or privacy policy.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design
Since the output from a generative AI component (such as an LLM) cannot be trusted, ensure that it operates in an untrusted or non-privileged space.
Operation
Use "semantic comparators," which are mechanisms that provide semantic comparison to identify objects that might appear different but are semantically similar.
Operation
Use components that operate externally to the system to monitor the output and act as a moderator. These components are called different terms, such as supervisors or guardrails.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
OWASP ASVS 4.0.3
V1.5.1 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62453 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Feb 2026, 07:28 UTC

WeaknessesCWE-1426

Technical details

References

Community reviews

Related threats