Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.
Date: 2026-06
Affected: microsoft/copilot
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2025-59252
CVE-2025-59272
CVE-2025-59286
CVE-2025-62222
CVE-2026-21256
CVE-2026-21257
CVE-2026-21516
CVE-2026-21518
CVE-2026-23653
CVE-2026-24299
CVE-2026-26129
CVE-2026-26136
CVE-2026-26164
CVE-2026-33111
CVE-2026-41090
CVE-2026-42827
CVE-2026-42893
CVE-2026-42895
CVE-2026-45497
CWE: CWE-138
CWE-20
CWE-74
CWE-77
CWE-94
CVSS: 7.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L)

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.


Mitigations:

Architectural layers (MAESTRO):