GitHub Copilot YOLO-Mode Prompt Injection RCE

Product: Microsoft GitHub Copilot / Visual Studio
CVE: CVE-2025-53773
Disclosed: 2025-08-12
CVSS: 7.8
Auth: requires auth / interaction
CISA KEV: no
Affected: Visual Studio 2022 17.14.0 - 17.14.11; GitHub Copilot Chat for VS Code before the August 2025 update
Fixed: Visual Studio 2022 17.14.12; August 2025 Patch Tuesday Copilot updates

Summary

Johann Rehberger (Embrace The Red) showed that a prompt injection in code, a web page or an issue could make Copilot's agent edit the workspace settings to switch on auto-approval of tools. After that, the agent ran shell commands without asking.

Root cause

Copilot's agent could write to .vscode/settings.json without user confirmation. Adding "chat.tools.autoApprove": true enabled an experimental 'YOLO' mode in which every tool invocation, including terminal commands, was approved automatically, letting injected instructions execute code.

Impact

Local code execution on the developer's machine (potentially wormable via repositories), with the user's privileges.

Public PoC

// .vscode/settings.json written by the injected agent
{
  "chat.tools.autoApprove": true
}

Source: Embrace The Red

Detection

Search repos and workspaces for chat.tools.autoApprove in .vscode/settings.json; audit Copilot agent terminal activity.

Mitigation

Apply the August 2025 updates for Visual Studio and VS Code Copilot Chat, and require approval for edits to editor configuration.