Critical GitHub Copilot Vulnerability Let Attackers Exfiltrate Source Code From Private Repos
A critical vulnerability in GitHub Copilot Chat, rated 9.6 on the CVSS scale, could have allowed attackers to exfiltrate source code and secrets from private repositories silently. The exploit combined a novel prompt injection technique with a bypass of…
A critical vulnerability in GitHub Copilot Chat, rated 9.6 on the CVSS scale, could have allowed attackers to exfiltrate source code and secrets from private repositories silently. The exploit combined a novel prompt injection technique with a bypass of GitHub’s Content Security Policy (CSP), granting the attacker control over a victim's Copilot instance. The vulnerability was responsibly reported via HackerOne, and GitHub has since addressed the issue.
The attack leveraged GitHub Copilot’s context-aware nature, which uses repository information to provide relevant answers. Researchers discovered that a malicious prompt could be embedded into a pull request description using GitHub's "invisible comments" feature. Although hidden in the user interface, Copilot processed these contents, allowing an attacker to compromise a developer's session by analyzing the pull request.
As Copilot operates with the permissions of the user making the request, the injected prompt could manipulate data from the victim’s private repositories.
The vulnerability was responsibly reported via HackerOne, and GitHub has since addressed the issue.
Bypassing Security With a URL Dictionary
A significant challenge for the attacker was GitHub’s strict Content Security Policy (CSP) , which prevents data leakage to external domains. GitHub uses a proxy service, Camo, to securely render images from third-party sites by rewriting external image URLs into signed camo.githubusercontent.com links.
To bypass this, the researcher generated a dictionary of valid Camo URLs for every character. Each URL pointed to a transparent pixel on a controlled server. The final prompt instructed Copilot to find sensitive information, such as an AWS key, in a private repository, and "draw" it using the Camo URL dictionary.
When rendered, these images sent requests to the attacker's server, leaking sensitive data character by character. GitHub remediated this vulnerability on Mon, Aug 14, 2025, by disabling all image rendering within the Copilot Chat feature, effectively neutralizing the attack vector.
Based on reporting by Cyber Security News.