GitHub Copilot's fetch_webpage tool let a crafted file-handler URI read files outside the workspace without approval

Undisclosed·GitHub Copilot (fetch_webpage tool), version 1.372.0

GitHub Copilot's fetch_webpage tool accepted a file-handler URI parameter that could point outside the active workspace folder and be read without user approval; because the tool consumes content from arbitrary fetched webpages, an indirect prompt injection embedded in a page could redirect the agent to read and exfiltrate local files it was never meant to access.

Blast radius

Not disclosed — the CVE record describes the vulnerability class (unauthorized out-of-workspace file access and potential exfiltration via the tool) but no victim count, exploited incident, or data loss is reported in the records retrieved.

Root cause

fetch_webpage did not constrain file-handler URI parameters to the workspace boundary, so content the agent fetched from the open web (untrusted, attacker-influenced) could steer the tool to paths outside the sandbox — a classic confused-deputy pattern enabled by indirect prompt injection.

How it was caught

Assigned CVE-2025-66389 and catalogued in NVD/OSV; no evidence in the retrieved pages of detection via an active exploit, only disclosure through the vulnerability-reporting pipeline.

Take-awayAny agent tool that both fetches untrusted external content and can touch the local filesystem needs the file-access path hard-constrained to the workspace root at the tool layer, not left to the model to respect — untrusted fetched content should never be able to influence a file-handler URI.