{
  "schema_version": "1.6.0",
  "id": "ACVE-2025-0010",
  "aliases": [
    "CVE-2025-53773"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-19T00:00:00Z",
  "summary": "VS Code Copilot Chat settings can auto-approve tools",
  "details": "## What the vulnerability is\n\nVS Code Copilot Chat can be exposed when tool approval is made automatic by a project setting or by a bypass-style permission mode. The referenced issue describes prompt-influenced project settings reaching `chat.tools.autoApprove`, which weakens the boundary between chat content and tool execution. The affected harness range in this record ends before `1.103.0`.\n\n## Which configuration is exposed\n\nThe matcher requires `harness.id` `vscode-copilot-chat` and then either `features[\"chat.tools.autoApprove\"]` equal to `true` or `permissionMode` equal to `bypassPermissions`. Those are the exact unsafe branches encoded by the rule. It does not require a particular tool, repository, prompt, or settings-file scope; the feature key is the lockfile's flat representation of the setting.\n\n## How ACVE detects it\n\nACVE reads `harness.id`, the flat feature key `features[\"chat.tools.autoApprove\"]`, and `permissionMode`. It cannot see whether a prompt injection wrote the value, which tools are allowlisted, or whether an approval dialog would have appeared. The match is therefore a configuration signal for an unsafe approval boundary.\n\n## Fix\n\n1. Upgrade the VS Code Copilot Chat component to `1.103.0` or later.\n2. Set `chat.tools.autoApprove` to `false` or remove the setting.\n3. Use an approval-required permission mode instead of `bypassPermissions`.\n\nThe two matcher branches are alternatives, so disabling only the feature key is insufficient when the effective permission mode is still `bypassPermissions`.\n\nThe two matcher branches are alternatives, so disabling only the feature key is insufficient when the effective permission mode is still `bypassPermissions`.\n\nThe package upgrade and both configuration changes should be verified in the effective lockfile rather than assumed from a single project setting.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "vscode-copilot-chat"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.103.0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53773"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=CVE-2025-53773"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "8"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "vulnClasses": [
        "config-file-injection",
        "unsafe-permission-mode"
      ],
      "cwe": [
        "CWE-15"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01 Agent Goal Hijack"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "vscode-copilot-chat"
          },
          {
            "any": [
              {
                "field": "features[\"chat.tools.autoApprove\"]",
                "op": "eq",
                "value": true
              },
              {
                "field": "permissionMode",
                "op": "eq",
                "value": "bypassPermissions"
              }
            ]
          }
        ]
      },
      "fix": {
        "summary": "Upgrade Copilot Chat and disable automatic tool approval.",
        "actions": [
          {
            "type": "upgrade",
            "target": "harness:vscode-copilot-chat",
            "to": "1.103.0",
            "why": "Use the fixed release."
          },
          {
            "type": "reconfigure",
            "target": "settings:vscode-copilot-chat:chat.tools.autoApprove",
            "to": "false",
            "why": "Keep chat content from automatically approving tool calls."
          },
          {
            "type": "reconfigure",
            "target": "agent.permissionMode",
            "to": "default",
            "why": "Preserve an approval boundary for tool execution."
          }
        ]
      },
      "exposure": "local",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:26Z",
          "found": false,
          "aliasesConfirmed": [],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": []
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:26Z",
          "found": false,
          "cvss": null,
          "published": null
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:26Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:26Z",
          "confirmed": [],
          "missing": []
        }
      }
    }
  }
}