GitHub Copilot for JetBrains RCE via malicious repo/PR
Date: 2025-11
Affected: GitHub Copilot for JetBrains
Attack vector: prompt-injection
Category: real-world
Severity: High
CVE: CVE-2025-64671
CWE: CWE-77
CVSS: 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

High-severity RCE in GitHub Copilot JetBrains plugin: opening a malicious repository or reviewing a social-engineered PR allows attackers to execute arbitrary commands on the developer machine.


Mitigations:

Architectural layers (MAESTRO):