VS Code Copilot Chat applyPatchTool TOCTOU bypass lets prompt injection write arbitrary files and achieve RCE, exfiltrating GITHUB_TOKEN

Linha do tempo

1. hacktron.ai ↗ · pub. 12/05/2026 21:00 · coletado 19/10 18:03 primeiro registro

   VS Code Copilot Chat applyPatchTool TOCTOU bypass lets prompt injection write arbitrary files and achieve RCE, exfiltrating GITHUB_TOKEN

   ler a análise desta fonte ocultar

   Researcher ahacker1, using the Hacktron AI tooling, disclosed a bypass of earlier fixes for prompt-injection-to-RCE in VS Code Copilot Chat agent mode. A TOCTOU flaw in the applyPatchTool component lets a crafted prompt write files outside the workspace without user confirmation. The attack can be triggered by pasting a prompt into Copilot chat, or more realistically through a malicious GitHub issue: when a maintainer clicks "Code with agent mode", a Codespace opens and Copilot automatically processes the issue text. The published PoC overwrites .git/config with a malicious sshCommand and then triggers it via git.autofetch, exfiltrating the victim's GITHUB_TOKEN to an attacker-controlled webhook. No CVE is cited, and the article does not state whether a fix has shipped for this bypass.

   Technical Details

   • The confirmation step (prepareInvocation in src/extension/tools/node/applyPatchTool.tsx) collects paths only via identify_files_needed and identify_files_added, which parse *** Update File: and *** Add File: directives. They ignore the *** Move to: directive, so only the source path of a rename is checked.
   • The Parser class stores the unchecked destination in movePath, and generateUpdateTextDocumentEdit then calls workspaceEdit.renameFile(path, newPath, { overwrite: true }) followed by a content replace. A harmless-looking source file (e.g. f1) is therefore renamed onto a sensitive target such as .git/config or .vscode/settings.json.
   • PoC chain: patch 1 creates dummy files f1 and f2. Patch 2 moves f1 to .git/config (setting core.sshCommand to a curl call that sends $GITHUB_TOKEN and $GITHUB_REPOSITORY to a webhook.site URL) and moves f2 to .vscode/settings.json with {"git.autofetch": true}. When autofetch runs git fetch, the poisoned sshCommand executes and the token is leaked.
   • The prompt uses a social-engineering pretext (SOC 2 Type II compliance audit logging) to coax the model into applying the patches.
   • Model dependency: the attack works with GPT-4.1 (preferred), GPT-5-mini and Raptor-mini. Claude models do not have access to the tool, so victims with Anthropic models enabled or chosen (typically premium users) are not exposed in the issue-triggered variant. Regular users without a Copilot license, who default to GPT models, are the likely targets.

   Remediation

   • Update VS Code and the Copilot Chat extension to the latest version, and confirm that *** Move to: destinations are included in edit confirmation checks.
   • Avoid using "Code with agent mode" on issues from untrusted authors, and review issue content before launching agent workflows.
   • Treat .git/config and .vscode/settings.json changes made by an agent as sensitive, and scrutinize any confirmation prompt.
   • Limit the scope and lifetime of the GITHUB_TOKEN exposed in Codespaces, and rotate the token if compromise is suspected.
   • Where policy allows, manage which Copilot models are enabled through account or enterprise AI controls.