ACVE-2025-0010

The configuration

Configuration label

vscode-copilot-chat + chat.tools.autoApprove=true | permissionMode=bypassPermissions

Affected entries

• AgentHarness: vscode-copilot-chat — SEMVER (introduced 0; fixed 1.103.0)

Matcher

• all
  • harness.id eq "vscode-copilot-chat"
  • any
    • features["chat.tools.autoApprove"] eq true
    • permissionMode eq "bypassPermissions"

Why it is exploitable

What the vulnerability is

VS Code Copilot Chat can be exposed when tool approval is made automatic by a project setting or by a bypass-style permission mode. The referenced issue describes prompt-influenced project settings reaching chat.tools.autoApprove, which weakens the boundary between chat content and tool execution. The affected harness range in this record ends before 1.103.0.

Which configuration is exposed

The matcher requires harness.id vscode-copilot-chat and then either features["chat.tools.autoApprove"] equal to true or permissionMode equal to bypassPermissions. Those are the exact unsafe branches encoded by the rule. It does not require a particular tool, repository, prompt, or settings-file scope; the feature key is the lockfile's flat representation of the setting.

How ACVE detects it

ACVE reads harness.id, the flat feature key features["chat.tools.autoApprove"], and permissionMode. It cannot see whether a prompt injection wrote the value, which tools are allowlisted, or whether an approval dialog would have appeared. The match is therefore a configuration signal for an unsafe approval boundary.

Fix

1. Upgrade the VS Code Copilot Chat component to 1.103.0 or later.
2. Set chat.tools.autoApprove to false or remove the setting.
3. Use an approval-required permission mode instead of bypassPermissions.

The two matcher branches are alternatives, so disabling only the feature key is insufficient when the effective permission mode is still bypassPermissions.

The two matcher branches are alternatives, so disabling only the feature key is insufficient when the effective permission mode is still bypassPermissions.

The package upgrade and both configuration changes should be verified in the effective lockfile rather than assumed from a single project setting.

References

See references for primary sources.

Underlying CVEs / aliases

• CVE-2025-53773

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Upgrade Copilot Chat and disable automatic tool approval.

Validation

No validation entries recorded.

Grounding

• OSV: not found; checked-at 2026-09-20T02:43:26Z
• NVD: not found; checked-at 2026-09-20T02:43:26Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:26Z

References

ADVISORY

• https://nvd.nist.gov/vuln/detail/CVE-2025-53773

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=CVE-2025-53773