This vulnerability (CVE-2026-23653) affects Microsoft Visual Studio Code CoPilot Chat Extension version 0.27.0 and is categorized under CWE-77 (Improper Neutralization of Special Elements used in a Command). It allows an attacker with authorized access to perform command injection, potentially leading to unauthorized information disclosure over the network. The CVSS 3.1 base score is 5.7, indicating a medium severity level. Microsoft has released an official fix to address this vulnerability, and no active exploitation has been reported.

Successful exploitation of this vulnerability could allow an authorized attacker to execute injected commands that disclose sensitive information over the network. There is no impact on integrity or availability reported. The vulnerability requires low attack complexity and privileges but user interaction is required. No known exploits in the wild have been reported.

An official fix is available from Microsoft. Users of Microsoft Visual Studio Code CoPilot Chat Extension version 0.27.0 should apply the vendor-provided patch as soon as possible. Refer to the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23653 for detailed remediation instructions.