CVE-2025-64671

High · 7.8

CVSS

7.8

EPSS

0.4%

Published

Dec 9, 2025

CISA due date

—

The record

Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally.

Affected packages

Ecosystem	Package	Introduced	Fixed