This vulnerability (CWE-77) in Microsoft Copilot Web involves improper neutralization of special elements used in commands, enabling command injection. An attacker could exploit this flaw to disclose sensitive information over a network. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. Microsoft has published an official fix for this vulnerability.

Successful exploitation can lead to high impact on confidentiality, integrity, and availability, including unauthorized information disclosure and potential system compromise. The vulnerability allows remote attackers to execute injected commands due to insufficient input sanitization.

An official fix is available from Microsoft. Users and administrators should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24301 to remediate this vulnerability.