CVE-2026-20841

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Command Injection Vulnerability in GitHub Copilot and Windows Notepad A command injection vulnerability has been identified in GitHub Copilot, Visual Studio, and the Windows Notepad app, allowing unauthorized attackers to execute code over a network. The issue arises from improper neutralization of special elements used in commands. A proof of concept for CVE-2026-20841 was made public shortly after its publication. 3 sources 14