Here's the full writeup of CVE-2025-53773 - Visual Studio & Copilot – Wormable Command Execution via Prompt Injection: https://www.persistent-security.net/post/part-iii-vscode-copilot-wormable-command-execution-via-prompt-injection

Patch now!

The full poc is here: https://github.com/persistent-security/poc-ai-copilot-rce

Looks like I've got some LLM-to-RCE CVE assigned by Microsoft for Visual Studio / Copilot: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53773

As often the exploitability is claimed to be not likely..We will fix that tomorrow in a blog post, stay tuned!