CVE-2025-53773

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
MicrosoftMicrosoft Visual Studio 2022 version 17.14>= 17.14.0, < 17.14.12

References

Timeline

Published
Aug 12, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-537747.5Microsoft 365 Copilot BizChat Information Disclosure VulnerabilityCVE-2025-537788.8Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network.CVE-2025-537797.2Relative path traversal in Windows Kerberos allows an authorized attacker to elevate privileges over a network.CVE-2025-53786.1A vulnerability classified as problematic has been found in Astun Technology iShare Maps 5.4.0. This affects an unknown part of the file mycCVE-2025-537816.5Exposure of sensitive information to an unauthorized actor in Azure Virtual Machines allows an authorized attacker to disclose information oCVE-2025-537827.8Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locaCVE-2025-537837.5Heap-based buffer overflow in Microsoft Teams allows an unauthorized attacker to execute code over a network.CVE-2025-537848.4Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-537868.0On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. MicroCVE-2025-537877.5Microsoft 365 Copilot BizChat Information Disclosure VulnerabilityCVE-2025-537887.0Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locallyCVE-2025-537897.8Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
CVE-2025-53773: High severity, CVSS 7.8 | Vulnix