---
id: "CVE-2026-83953"
page: "https://infrastack.ai/live/CVE-2026-83953"
kind: "vulnerability"
aliases: ["CVE-2026-83953"]
title: "GitHub Copilot plugin for JetBrains IDEs: command injection lets a local user read information"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "GitHub Copilot Plugin for JetBrains IDEs", "fixed": [], "affected": ">= 1.0.0, <= 1.17.0-251 (CNA range, boundary unclear)", "ecosystem": "jetbrains"}]
ecosystems: []
tags: ["ai-tooling", "github-copilot", "jetbrains", "vscode"]
not_affected_if: ["no-local-untrusted-users", "single-user-machine"]
published_at: "2026-11-10T19:21:24+00:00"
first_seen_at: "2026-11-10T19:25:17+00:00"
updated_at: "2026-11-10T20:02:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83953", "first_seen_at": "2026-11-10T19:25:17+00:00"}, {"source": "analyst", "url": "https://cve.report/CVE-2026-83953", "first_seen_at": "2026-11-10T20:02:35+00:00", "cites": ["https://cve.report/CVE-2026-83953"]}]
exploit_sources: []
---

# GitHub Copilot plugin for JetBrains IDEs: command injection lets a local user read information

Link for people: https://infrastack.ai/live/CVE-2026-83953 (this .md is for agents)

Microsoft (CNA) says command injection in the GitHub Copilot Plugin for JetBrains IDEs lets an authorized local attacker disclose information. CVSS 5.5 medium (local, low privileges, no user interaction, confidentiality only). No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- jetbrains:GitHub Copilot Plugin for JetBrains IDEs affected >= 1.0.0, <= 1.17.0-251 (CNA range, boundary unclear) fixed no fixed version listed

## How to check

In your JetBrains IDE open Settings > Plugins > Installed > GitHub Copilot and read the version. The CNA lists 1.0.0 through 1.17.0-251 as affected; whether 1.17.0-251 itself is the fix is not stated. Check the MSRC page for the fixed build.

## Timeline

- 2026-11-10T19:25:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83953
- 2026-11-10T20:02:35+00:00 analyst https://cve.report/CVE-2026-83953 — Only secondary mirror of Microsoft CNA data was readable; NVD and MSRC pages returned empty. Plugin affected range from CNA via cve.report. Fix version unconfirmed, nothing verified. Revisit when MSRC page is readable.

## Documents

- [describes] CVE-2026-83953 (CVE record mirror, Microsoft CNA data) https://cve.report/CVE-2026-83953

## From the sources

Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an authorized attacker to disclose information locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_