CVE-2025-64671
Published: 09 December 2025
Summary
CVE-2025-64671 is a high-severity Command Injection (CWE-77) vulnerability in Microsoft Github Copilot. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 30.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly addresses the command injection vulnerability in Copilot by applying vendor patches to prevent unauthorized local code execution.
Information input validation neutralizes special elements in commands processed by Copilot, directly mitigating the improper neutralization flaw.
Malicious code protection mechanisms detect and block arbitrary code execution resulting from command injection exploits in Copilot.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local command injection vulnerability (AV:L/PR:N) enables unauthorized attackers to achieve arbitrary code execution without privileges, directly facilitating Exploitation for Privilege Escalation.
NVD Description
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally.
Deeper analysisAI
CVE-2025-64671 is a command injection vulnerability (CWE-77) in Copilot, caused by improper neutralization of special elements used in a command. This flaw enables an unauthorized attacker to execute code locally on affected systems. Published on 2025-12-09, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A local attacker can exploit this vulnerability with low complexity, requiring no privileges or user interaction. Successful exploitation grants the attacker the ability to execute arbitrary code locally, resulting in high impacts to confidentiality, integrity, and availability.
The Microsoft Security Response Center has published an update guide with mitigation details at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64671.
Details
- CWE(s)