CVE-2025-53773Disclosure(microsoft / visual_studio_2022)

Sharing some personal experience with MSRC: First upfront disclaimer: I've not reported many vulnerabilities to them so far, but some high profile ones like CVE-2025-53773 and CVE-2020-16875. Mainly because I was never very active in Windows specific security research, only as a code reviewer for proprietary software. So I can't claim I'm an expert in dealing with MSRC. The few times I have dealt with them though showed one pattern: There was always a political and corporate communication angle to any conversation and interaction. and that was much stronger than with any other of the many corporations I had to deal with over the years. Where for other vendors the technical details and impact was always first, it felt like there was a filter in my interactions that delayed communication. I didn't even get an update for when something was fixed. On top of it it was never transparent who is actually looking at the vulnerabilities. In case of CVE-2020-16875 the bug was not patched correctly at least two times, despite me proposing a patch and offering help looking at theirs. I've met a few MSRC folks at conferences over the past last years and everyone was super nice and skilled! So what we can conclude: "A fish rots from the head down" Microsoft should just hand over the process to people who manage it well and own their mistakes as a corporation in a proper way. Others have successfully done it before!

One injection. One config write. Full RCE on the developer's machine. That's CVE-2025-53773, and it's the pattern behind every MCP escalation chain. Part 4 breaks it down hop by hop. https://medium.com/@Aacle/3-hops-to-rce-mcp-security-part-4-c1e6498c7b4c?sk=2a2e4db4ed9c991d4896470fa64e12a5

An Important message for all Vibe Coders. Even downloading a repo can get you hacked...📌📌 CVE-2025-53773 is a wild reminder of how easily a prompt injection can escalate into full Remote Code Execution (RCE) on your machine. The exploit chain is terrifyingly simple: 1. The Poisoned Context: An attacker hides a malicious prompt inside a repo comment or README. 2. The Privilege Escalation: Copilot reads it and is tricked into silently modifying .vscode/settings.json to enable YOLO mode ("http://chat.tools.autoApprove": true). 3. The Payload: With human confirmation disabled, the agent immediately opens a terminal and executes arbitrary bash commands on behalf of the attacker. No malicious links clicked. You just opened a workspace, and your assistant compromised your environment. The Golden Rule for building with autonomous agents: Never give an agent write access to the configuration files that govern its own boundaries. Stay secure while you ship. 🛠️ If you are shipping, then we should connect...

Exhibit A: GitHub Copilot RCE (CVE-2025-53773). A hidden prompt in a README could hijack a developer's entire workstation. A linguistic input escalated to full system compromise. Read that again.

AI Exploitation Techniques AI exploitation techniques have evolved from theoretical research to weaponized attacks against production systems. GitHub Copilot suffered CVE-2025-53773 (CVSS 9.6), enabling remote code execution through prompt injection. Microsoft patched a zero-click data exfiltration flaw (EchoLeak) in Copilot. PoisonedRAG achieved 90% attack success rates with just five injected documents. https://xhack.io/blog/ai-exploitation-techniques-a-complete-guide #AI #LLM #AISecurity

This is not theoretical. CVE-2025-53773 in GitHub Copilot and VS Code allowed an untrusted file with an embedded prompt injection to exploit the AI into enabling 'YOLO mode' and running unauthorized commands under user permissions. (10/n)

🔓 GitHub Copilot RCE (CVE-2025-53773) — injection hidden in repo comments → arbitrary code execution on dev machines. 🔓 MCP RCE (CVE-2025-6514) — 9.6 severity, in infra used by hundreds of thousands of devs. https://botmonster.com/posts/ai-coding-agent-insider-threat-prompt-injection-mcp-exploits/

Top 5 Trending CVEs: 1 - CVE-2025-53773 2 - CVE-2025-32711 3 - CVE-2022-0492 4 - CVE-2024-21182 5 - CVE-2026-0257 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard

The inverse case: ZombAIs (CVE-2025-53773). Prompt injection -> Copilot edits .vscode/settings.json to enable autoApprove -> terminal commands run unconfirmed -> RCE. Three boundaries failed at once. Most production systems have none of the three.

GitHub CopilotにRCE脆弱性CVE-2025-53773（パッチ済）。悪意あるPRコメントのプロンプトインジェクションでVSCode設定を書き換え、マルウェア実行・リポジトリ全体に伝播も。AIコーディングツールの攻撃面は本当に深刻🔒 https://ai-trend-watch.pages.dev/2026/04/20/github-copilot-cve-2025-53773/ #セキュリティ #GitHubCopilot #AIセキュリティ

這不是理論，是已經發生的事： - CVE-2025-6514：MCP OAuth RCE，43 萬裝機量 - CVE-2025-53773：Copilot 被注入開啟「YOLO 模式」，自動核准所有操作，可蠕蟲傳播 - postmark-mcp：npm 惡意套件，靜默轉發所有信件給攻擊者 - SANDWORM：19 個釣魚套件偷 SSH key 和 AWS 憑證

Real incidents, not theory: - CVE-2025-6514: MCP OAuth proxy RCE, 437K+ installs - CVE-2025-53773: Copilot "YOLO mode" — wormable RCE - postmark-mcp: malicious npm package forwarded all emails to attacker - SANDWORM: 19 typosquatted packages stealing SSH keys

This isn't theory. Look at CVE-2025-53773. A prompt injection can trigger "YOLO Mode" in your assistant, allowing Remote Code Execution (RCE) directly on your machine. And CVE-2026-2256 just proved that even MS-Agent isn't safe from logic-bypass attacks. https://t.co/nkwi3gmUN3

4/ The risk: Autopilot with auto-approved tool calls means arbitrary code execution on your dev machine. SSH keys, cloud credentials, API tokens, all accessible. Prompt injection is a documented attack vector (CVE-2025-53773). The attack surface just expanded to every IDE session.

Sec-Context: comprehensive AI code anti-patterns for LLMs — breadth (~65K tokens) and depth (~100K tokens) references. Top risks: dependency squatting, XSS, hardcoded secrets. #XSS #LLM #CVE-2025-53773 https://github.com/Arcanum-Sec/sec-context

EchoLeak (CVE-2025-32711) demonstrated zero-click data exfiltration from Microsoft 365 Copilot. GitHub Copilot’s CVE-2025-53773 (CVSS 9.6) enabled remote code execution through injected code comments. Security researcher Johann Rehberger spent $500 testing Devin AI and found it completely defenseless, allowing attackers to expose ports, leak tokens, and install malware through crafted prompts. The UK’s National Cyber Security Centre warned in December 2025 that prompt injection may never be fully mitigated with current architectures. This is XHack’s breakdown of how prompt injection works, every major attack variant, documented real-world incidents, and the defense strategies we implement and test across client engagements Read More at: https://xhack.io/blog/prompt-injection-attacks-risks-for-chatbots

⚠️ CRITICAL: GitHub Copilot has a Remote Code Execution vulnerability (CVE-2025-53773) Prompt injection can lead to RCE. If you're using Copilot in production, review your security posture NOW. #GitHub #Security #DevSecOps

プロンプトインジェクション、2026年も OWASP の LLM 脅威1位のまま。PR の説明文に隠したインジェクションで Copilot が RCE された CVE-2025-53773（9.6）とか、365 Copilot のゼロクリック情報漏洩 EchoLeak とか。コーディングエージェントに権限を渡しすぎると CI/CD がそのまま攻撃面になる。ツールごとの最小権限、ちゃんとやろう。 #セキュリティ #AIセキュリティ #DevSecOps https://www.securance.com/blog/prompt-injection-the-owasp-1-ai-threat-in-2026/

GitHub CopilotのPRコメントに隠れたプロンプトでRCE（CVE-2025-53773、CVSS 9.6）。PRの説明文がシェルコマンドになる時代に。AIコードレビューを使っているチームは今すぐパッチ確認を https://ai-trend-watch.pages.dev/2026/04/20/github-copilot-cve-2025-53773/ #GitHubCopilot #AIセキュリティ #脆弱性

AIコーディングの最大リスク、プロンプトインジェクション🤖 OWASPが2026年No.1 AI脅威に。PR説明に隠した注入でCopilotのRCE(CVE-2025-53773, CVSS9.6)、ゼロクリック流出のEchoLeak、Cursorのコマンド実行欠陥…成功率は構成次第で50〜84%。AIエージェントの実行権限を最小化しましょう。 #セキュリティ #AIセキュリティ #LLM #DevSecOps https://www.securance.com/blog/prompt-injection-the-owasp-1-ai-threat-in-2026/