{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-50510",
    "name": "CVE-2026-50510",
    "vendor": "GitHub Copilot plugin for JetBrains",
    "description": "Microsoft disclosed an improper resource-name restriction (CWE-641) in the GitHub Copilot plugin for JetBrains IDEs that allows local code execution after user interaction. Every version before 1.13.0-251 is affected, across IntelliJ IDEA, PyCharm, WebStorm, Rider, Android Studio and the other JetBrains IDEs. Plugin-level flaws like this are easy to miss in fleet inventory, because the IDE itself is patched and reports current while the vulnerable AI plugin inside it does not.",
    "website": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50510",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "ide-extension",
    "updatedAt": "2026-07-14",
    "risk": {
      "score": 78,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-50510",
      "aliases": [
        "ti-057"
      ],
      "title": "CVE-2026-50510: GitHub Copilot Plugin for JetBrains IDEs Allows Local Code Execution (CVSS 7.8)",
      "summary": "Microsoft disclosed an improper resource-name restriction (CWE-641) in the GitHub Copilot plugin for JetBrains IDEs that allows local code execution after user interaction. Every version before 1.13.0-251 is affected, across IntelliJ IDEA, PyCharm, WebStorm, Rider, Android Studio and the other JetBrains IDEs. Plugin-level flaws like this are easy to miss in fleet inventory, because the IDE itself is patched and reports current while the vulnerable AI plugin inside it does not.",
      "severity": "high",
      "cvss": {
        "score": 7.8,
        "vector": null,
        "version": null
      },
      "cwe": [
        "CWE-641"
      ],
      "attackType": [
        "Other"
      ],
      "componentType": "ide-extension",
      "component": {
        "name": "GitHub Copilot plugin for JetBrains",
        "vendor": null,
        "package": null,
        "ecosystem": "vscode",
        "catalogSlug": "agent/jetbrains"
      },
      "affected": [
        {
          "range": "GitHub Copilot plugin for JetBrains < 1.13.0-251",
          "fixed": "1.13.0-251"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-07-14",
      "modifiedAt": "2026-07-14",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "advisory",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50510"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50510"
        }
      ],
      "mitigation": "Update the GitHub Copilot JetBrains plugin to 1.13.0-251 or later on every JetBrains IDE in the fleet. Inventory AI plugin versions separately from IDE versions, since a current IDE can still carry a vulnerable plugin.",
      "detectedByAnomity": true
    }
  }
}