critical9.6
CVE-2026-48561
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute…
Impact
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | 365 Copilot | All versions |
| Microsoft | Microsoft Edge Copilot For Android | from 1.0.0 before publication |
| Microsoft | Microsoft Edge Copilot For IOS | from 1.0.0 before publication |