CVE-2026-50510: GitHub Copilot Plugin for JetBrains IDEs Allows Local Code Execution (CVSS 7.8)
CVE-2026-50510 is a high-severity security issue (CVSS 7.8) in GitHub Copilot plugin for JetBrains, an IDE extension. Affected: GitHub Copilot plugin for JetBrains < 1.13.0-251. Fixed in 1.13.0-251.
Is GitHub Copilot plugin for JetBrains running on your developers' machines? Anomity finds every device with this IDE extension installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2026-50510- Severity
- high
- CVSS score
- 7.8
- Attack type
- Other
- CWE
- CWE-641
- Component
- JetBrains IDEs · IDE extension
- Known exploited
- No known exploitation
- Published
- Last verified
What is CVE-2026-50510?
Microsoft disclosed an improper resource-name restriction (CWE-641) in the GitHub Copilot plugin for JetBrains IDEs that allows local code execution after user interaction. Every version before 1.13.0-251 is affected, across IntelliJ IDEA, PyCharm, WebStorm, Rider, Android Studio and the other JetBrains IDEs. Plugin-level flaws like this are easy to miss in fleet inventory, because the IDE itself is patched and reports current while the vulnerable AI plugin inside it does not.
Affected versions
| Affected | Fixed in |
|---|---|
GitHub Copilot plugin for JetBrains < 1.13.0-251 | 1.13.0-251 |
Am I affected by CVE-2026-50510?
You are affected if you run GitHub Copilot plugin for JetBrains < 1.13.0-251. Versions 1.13.0-251 and later include the fix.
How do I fix CVE-2026-50510?
Update the GitHub Copilot JetBrains plugin to 1.13.0-251 or later on every JetBrains IDE in the fleet. Inventory AI plugin versions separately from IDE versions, since a current IDE can still carry a vulnerable plugin.
How do I find every machine running GitHub Copilot plugin for JetBrains?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run GitHub Copilot plugin for JetBrains and which version, then enforce a policy on it.