CVE-2026-24301

HIGH8.8Published on August 18, 2026

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

CVSS score8.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-77

CoSnitch, Copilot poteva eseguire prompt da un link e sottrarre dati personali

CoSnitch: Copilot Could Execute Prompts from a Link and Steal Personal Data

Varonis Threat Labs identified a vulnerability chain in Microsoft Copilot Personal that could turn a simple link click into the automatic execution of

Aug 19, 20264 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

CoSnitch: Copilot Could Execute Prompts from a Link and Steal Personal Data