Vulnerabilities in code written with GitHub Copilot

20 published CVEs and GitHub advisories where a change made with GitHub Copilot introduced the flaw, exposed the vulnerable path, or left a security fix incomplete, across 16 projects. Most common root cause: injection & unsafe execution.

Findings: 20; 7% of all 284
Projects: 16; Most: microsoft/prompty (3)
Critical or high: 3; of 7 with a severity score
Latest advisory: Aug 5, 2026; Data through Sep 26, 2026

Search and filter these findings →

Findings per month

May 2025Peak advisory month: Jul 2026Sep 2026

By advisory publication month. The latest month is partial.

Root causes

What went wrong in findings that involve GitHub Copilot.

How AI contributed

Whether the AI-assisted change introduced the flaw, widened exposure, or left a fix incomplete.

Languages

Primary language of the affected repository.

All 20 findings

Newest first

The AI-coauthored sandbox hardening rewrote js-task-runner to freeze global prototypes and Buffer helpers, but its freeze loop skipped function-typed prototypes (typeof Function.prototype is function). A workflow author could still pollute Function.prototype, recover host globals, and with an allowlisted import escape the VM sandbox.
CVE-2026-77083Aug 5, 2026n8n-io/n8nTypeScriptGitHub CopilotFlawed AI-written codeInjection & unsafe execution
Copilot SWE-agent changed wildcard escaping without matching native PostgreSQL SQL, so unauthenticated searches could force broad scans and degrade availability.
CVE-2026-76212Aug 4, 2026thorsten/phpmyfaqPHPGitHub CopilotDirect introductionInjection & unsafe execution
The GitHub Copilot coding agent extended a pre-existing human-written flaw — interpolating unvalidated arguments into DQL — by adding unquoted timeframe interpolation to list_vulnerabilities and get_kubernetes_events, the latter already vulnerable through its clusterId sink.
GHSA-PQH8-P93P-2RX7Jul 31, 2026dynatrace-oss/dynatrace-mcpTypeScriptGitHub CopilotFlawed AI-written codeInjection & unsafe execution
An AI-assisted change let a connecting client pick the Consul API address with a request header, so the server could be pointed at an attacker-controlled endpoint and send along the Consul token it was configured with.
CVE-2026-16328Jul 29, 2026hashicorp/consul-mcp-serverGoGitHub CopilotDirect introductionSSRF & network boundaries
AI-written TerraformContextMiddleware trusted a client-supplied TFE_ADDRESS, redirecting server-side Terraform API requests and leaking the Terraform token to attackers.
CVE-2026-14869Jul 28, 2026hashicorp/terraform-mcp-serverGoGitHub CopilotFlawed AI-written codeSSRF & network boundaries
GitHub Copilot co-wrote an incomplete fix that added a raw-string check to IsSafeFileReference, which failed to decode or normalize the reference and so still allowed the bypass that earlier human-written code left open.
MediumGHSA-P5RM-JG5C-8C77Jul 24, 2026microsoft/kiotaC#GitHub CopilotFlawed AI-written codePath & link handling
Copilot-assisted TypeScript code rendered attacker-controlled Nunjucks templates with host objects and unrestricted JavaScript member access. The direct fix blocks prototype traversal and function calls and exposes only copied own data.
CriticalCVE-2026-73299Jul 24, 2026microsoft/promptyRustGitHub CopilotFlawed AI-written codeInjection & unsafe execution
A Copilot-assisted TypeScript runtime loaded .prompty files through gray-matter with the library's default frontmatter engines, so a file that opened with a JavaScript frontmatter block ran its code during parsing. The repair rejects JavaScript frontmatter outright.
CVE-2026-53597Jul 17, 2026microsoft/promptyTypeScriptGitHub CopilotFlawed AI-written codeInjection & unsafe execution
A Copilot-assisted TypeScript loader read file references without checking where they resolved. A malicious prompt could use an absolute path or traversal to read files available to the host process.
HighCVE-2026-53598Jul 17, 2026microsoft/promptyRustGitHub CopilotFlawed AI-written codePath & link handling
AI-written code used eval with an empty locals dict, falsely assuming it was safe, enabling LLM-generated expressions to reach builtins and achieve RCE.
CVE-2026-54769Jul 6, 2026langroid/langroidPythonGitHub CopilotFlawed AI-written codeInjection & unsafe execution
A Copilot-co-authored change meant to bound recursion in Scriban's array initializers reused a depth check that only logged an error, so deeply nested templates could still crash the host with an uncatchable stack overflow.
MediumCVE-2026-74783Jun 26, 2026scriban/scribanC#GitHub CopilotIncomplete remediationResource abuse & availability
Copilot-assisted sandbox code silently fell back to a plain subprocess when Landlock was unavailable, letting untrusted code bypass the configured filesystem and network restrictions.
CVE-2026-57144Jun 18, 2026mervinpraison/praisonaiPythonGitHub CopilotFlawed AI-written codeAuthentication & access control
A change generated with Claude Code introduced the vulnerable behavior: when LINEAR_WEBHOOK_SECRET is unset, LinearBot skips Linear-Signature verification, so a forged webhook event can run the configured agent.
CVE-2026-56837Jun 18, 2026mervinpraison/praisonaiPythonGitHub CopilotDirect introductionAuthentication & access control
AI-written code returned raw MCP server configs with unredacted secrets to non-owner users, exposing provider credentials.
CVE-2026-44653Jun 2, 2026danny-avila/librechatTypeScriptGitHub CopilotFlawed AI-written codeAuthentication & access control
Copilot wrote the legacy-bundle probe that extracts untrusted archives with raw extractall on Python before 3.12, introducing the escape for .. and absolute member names.
CVE-2026-46383May 15, 2026microsoft/apmPythonGitHub CopilotDirect introductionOther or unclear
The GitHub Copilot coding agent copied the existing unguarded directory-entry branch into WriteToDirectory, guarded only file entries, and wrote a new async route that still carried the flaw.
MediumCVE-2026-44788May 8, 2026adamhathcock/sharpcompressC#GitHub CopilotFlawed AI-written codePath & link handling
The AI-written code embedded an attacker-influenced OpenAPI spec via unescaped JSON into a script tag, enabling stored XSS when the docs page is viewed.
HighCVE-2026-33331Mar 20, 2026middleapi/orpcTypeScriptGitHub CopilotDirect introductionInjection & unsafe execution
Android's AI-written device_shell blocklist only checked literal substrings, so permuted destructive commands like rm -fr bypassed it and reached the device.
GHSA-HHJV-JQ77-CMVXMar 5, 2026qhkm/zeptoclawRustGitHub CopilotDirect introductionInjection & unsafe execution
GitHub Copilot coding agent wrote the node:vm sandbox that replaced vm2 and kept passing host-realm intrinsics into the context, so the pre-existing admin-script feature stayed exploitable.
CVE-2025-69288Dec 31, 2025kromitgmbh/titraJavaScriptGitHub CopilotFlawed AI-written codeInjection & unsafe execution
The GitHub Copilot coding agent's change switched the self-service writers to strip_tags and made UserData::get() decode the stored display name, introducing the vulnerable behavior that the earlier human unescaped output then made exploitable.
MediumCVE-2025-68951Dec 29, 2025thorsten/phpmyfaqPHPGitHub CopilotDirect introductionInjection & unsafe execution