Vulnerability-Lookup

CVE-2026-29783 (GCVE-0-2026-29783)

Vulnerability from cvelistv5 – Published: 2026-03-06 16:39 – Updated: 2026-03-06 18:06

Title

GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command execution

Summary

The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent (e.g., via prompt injection through repository files, MCP server responses, or user instructions) can exploit bash parameter transformation operators to execute hidden commands, bypassing the safety assessment that classifies commands as "read-only." This has been patched in version 0.0.423. The vulnerability stems from how the CLI's shell safety assessment evaluates commands before execution. The safety layer parses and classifies shell commands as either read-only (safe) or write-capable (requires user approval). However, several bash parameter expansion features can embed executable code within arguments to otherwise read-only commands, causing them to appear safe while actually performing arbitrary operations. The specific dangerous patterns are ${var@P}, ${var=value} / ${var:=value}, ${!var}, and nested $(cmd) or <(cmd) inside ${...} expansions. An attacker who can influence command text sent to the shell tool - for example, through prompt injection via malicious repository content (README files, code comments, issue bodies), compromised or malicious MCP server responses, or crafted user instructions containing obfuscated commands - could achieve arbitrary code execution on the user's workstation. This is possible even in permission modes that require user approval for write operations, since the commands can appear to use only read-only utilities to ultimately trigger write operations. Successful exploitation could lead to data exfiltration, file modification, or further system compromise.

Severity ?

7.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/github/copilot-cli/security/ad…	x_refsource_CONFIRM
	https://github.com/github/copilot-cli/releases/ta…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	github	copilot-cli	Affected: <= 0.0.422

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-29783",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-06T18:05:42.526540Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-06T18:06:00.863Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "copilot-cli",
          "vendor": "github",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 0.0.422"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent (e.g., via prompt injection through repository files, MCP server responses, or user instructions) can exploit bash parameter transformation operators to execute hidden commands, bypassing the safety assessment that classifies commands as \"read-only.\" This has been patched in version 0.0.423. \n\nThe vulnerability stems from how the CLI\u0027s shell safety assessment evaluates commands before execution. The safety layer parses and classifies shell commands as either read-only (safe) or write-capable (requires user approval). However, several bash parameter expansion features can embed executable code within arguments to otherwise read-only commands, causing them to appear safe while actually performing arbitrary operations.\n\nThe specific dangerous patterns are ${var@P}, ${var=value} / ${var:=value}, ${!var}, and nested $(cmd) or \u003c(cmd) inside ${...} expansions. An attacker who can influence command text sent to the shell tool - for example, through prompt injection via malicious repository content (README files, code comments, issue bodies), compromised or malicious MCP server responses, or crafted user instructions containing obfuscated commands - could achieve arbitrary code execution on the user\u0027s workstation. This is possible even in permission modes that require user approval for write operations, since the commands can appear to use only read-only utilities to ultimately trigger write operations. Successful exploitation could lead to data exfiltration, file modification, or further system compromise."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-06T16:50:41.728Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/github/copilot-cli/security/advisories/GHSA-g8r9-g2v8-jv6f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/github/copilot-cli/security/advisories/GHSA-g8r9-g2v8-jv6f"
        },
        {
          "name": "https://github.com/github/copilot-cli/releases/tag/v0.0.423",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/github/copilot-cli/releases/tag/v0.0.423"
        }
      ],
      "source": {
        "advisory": "GHSA-g8r9-g2v8-jv6f",
        "discovery": "UNKNOWN"
      },
      "title": "GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-29783",
    "datePublished": "2026-03-06T16:39:27.424Z",
    "dateReserved": "2026-03-04T16:26:02.898Z",
    "dateUpdated": "2026-03-06T18:06:00.863Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-29783\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-06T17:16:35.487\",\"lastModified\":\"2026-03-06T17:16:35.487\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent (e.g., via prompt injection through repository files, MCP server responses, or user instructions) can exploit bash parameter transformation operators to execute hidden commands, bypassing the safety assessment that classifies commands as \\\"read-only.\\\" This has been patched in version 0.0.423. \\n\\nThe vulnerability stems from how the CLI\u0027s shell safety assessment evaluates commands before execution. The safety layer parses and classifies shell commands as either read-only (safe) or write-capable (requires user approval). However, several bash parameter expansion features can embed executable code within arguments to otherwise read-only commands, causing them to appear safe while actually performing arbitrary operations.\\n\\nThe specific dangerous patterns are ${var@P}, ${var=value} / ${var:=value}, ${!var}, and nested $(cmd) or \u003c(cmd) inside ${...} expansions. An attacker who can influence command text sent to the shell tool - for example, through prompt injection via malicious repository content (README files, code comments, issue bodies), compromised or malicious MCP server responses, or crafted user instructions containing obfuscated commands - could achieve arbitrary code execution on the user\u0027s workstation. This is possible even in permission modes that require user approval for write operations, since the commands can appear to use only read-only utilities to ultimately trigger write operations. Successful exploitation could lead to data exfiltration, file modification, or further system compromise.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://github.com/github/copilot-cli/releases/tag/v0.0.423\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/github/copilot-cli/security/advisories/GHSA-g8r9-g2v8-jv6f\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-29783\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-06T18:05:42.526540Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-06T18:05:55.613Z\"}}], \"cna\": {\"title\": \"GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command execution\", \"source\": {\"advisory\": \"GHSA-g8r9-g2v8-jv6f\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"github\", \"product\": \"copilot-cli\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 0.0.422\"}]}], \"references\": [{\"url\": \"https://github.com/github/copilot-cli/security/advisories/GHSA-g8r9-g2v8-jv6f\", \"name\": \"https://github.com/github/copilot-cli/security/advisories/GHSA-g8r9-g2v8-jv6f\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/github/copilot-cli/releases/tag/v0.0.423\", \"name\": \"https://github.com/github/copilot-cli/releases/tag/v0.0.423\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent (e.g., via prompt injection through repository files, MCP server responses, or user instructions) can exploit bash parameter transformation operators to execute hidden commands, bypassing the safety assessment that classifies commands as \\\"read-only.\\\" This has been patched in version 0.0.423. \\n\\nThe vulnerability stems from how the CLI\u0027s shell safety assessment evaluates commands before execution. The safety layer parses and classifies shell commands as either read-only (safe) or write-capable (requires user approval). However, several bash parameter expansion features can embed executable code within arguments to otherwise read-only commands, causing them to appear safe while actually performing arbitrary operations.\\n\\nThe specific dangerous patterns are ${var@P}, ${var=value} / ${var:=value}, ${!var}, and nested $(cmd) or \u003c(cmd) inside ${...} expansions. An attacker who can influence command text sent to the shell tool - for example, through prompt injection via malicious repository content (README files, code comments, issue bodies), compromised or malicious MCP server responses, or crafted user instructions containing obfuscated commands - could achieve arbitrary code execution on the user\u0027s workstation. This is possible even in permission modes that require user approval for write operations, since the commands can appear to use only read-only utilities to ultimately trigger write operations. Successful exploitation could lead to data exfiltration, file modification, or further system compromise.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-06T16:50:41.728Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-29783\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-06T18:06:00.863Z\", \"dateReserved\": \"2026-03-04T16:26:02.898Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-06T16:39:27.424Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-G8R9-G2V8-JV6F

Vulnerability from github – Published: 2026-03-06 16:43 – Updated: 2026-03-06 22:44

Summary

GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution

Details

Summary

A security vulnerability has been identified in GitHub Copilot CLI's shell tool that could allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent (e.g., via prompt injection through repository files, MCP server responses, or user instructions) can exploit bash parameter transformation operators to execute hidden commands, bypassing the safety assessment that classifies commands as "read-only."

Details

The vulnerability stems from how the CLI's shell safety assessment evaluates commands before execution. The safety layer parses and classifies shell commands as either read-only (safe) or write-capable (requires user approval). However, several bash parameter expansion features can embed executable code within arguments to otherwise read-only commands, causing them to appear safe while actually performing arbitrary operations.

The specific dangerous patterns are:

${var@P} — Prompt expansion: The @P parameter transformation operator evaluates its value as a prompt string, which interprets embedded command substitutions. This allows hidden command execution inside what appears to be a simple variable reference.
${var=value} / ${var:=value} — Assignment side-effects: These forms assign values to variables as a side-effect of expansion. When chained with @P, an attacker can progressively build up a command substitution string across multiple expansions.
${!var} — Indirect expansion: Dereferences an arbitrary variable name, which can be combined with other patterns to construct and execute commands dynamically.
Nested $(cmd) or <(cmd) inside ${...} expansions: Command substitution or process substitution embedded within parameter expansion default values (e.g., ${HOME:-$(whoami)}) executes the nested command.

Proof of Concept

The following command appears to run a harmless echo, but actually executes touch /tmp/pwned through chained parameter expansion:

echo ${a="$"}${b="$a(touch /tmp/pwned)"}${b@P}

How it works: - ${a="$"} assigns the literal $ character to variable a - ${b="$a(touch /tmp/pwned)"} expands $a to $, constructing the string $(touch /tmp/pwned) and assigning it to b - ${b@P} applies prompt expansion to b, which evaluates the embedded $(touch /tmp/pwned) command substitution

Prior to the fix, the safety assessment would classify echo as a read-only command and allow execution without user confirmation — even in modes that normally require approval for write operations.

Impact

An attacker who can influence command text sent to the shell tool — for example, through: - Prompt injection via malicious repository content (README files, code comments, issue bodies) - Compromised or malicious MCP server responses - Crafted user instructions containing obfuscated commands

— could achieve arbitrary code execution on the user's workstation. This is possible even in permission modes that require user approval for write operations, since the commands can appear to be using only read-only utilities to ultimately trigger write operations.

Successful exploitation could lead to data exfiltration, file modification, or further system compromise.

Affected Versions

GitHub Copilot CLI versions prior to 0.0.423

Remediation and Mitigation

Fix

The fix adds two layers of defense:

Parse-time detection: The shell safety assessment analyzes ${...} expansion nodes within bash commands, detecting dangerous operators (@P, =, :=, !) and nested command/process substitutions. Commands containing these patterns are downgraded from read-only to write-capable, ensuring they require user approval.
Unconditional blocking: Commands with dangerous expansion patterns are unconditionally blocked at the tool execution layer — regardless of permission mode (including --yolo / autopilot). This prevents exploitation even when all commands are auto-approved.
System prompt hardening: The bash shell tool's system prompt now includes explicit instructions for the LLM to refuse executing commands with these patterns, providing a defense-in-depth layer.

User Actions

Upgrade GitHub Copilot CLI to 0.0.423 or later.
Exercise caution when working in untrusted repositories or with untrusted MCP servers.
Review any shell commands suggested by the agent that contain complex parameter expansion patterns.

Severity ?

7.5 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.0.422"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@github/copilot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.423"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-29783"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-06T16:43:31Z",
    "nvd_published_at": "2026-03-06T17:16:35Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nA security vulnerability has been identified in GitHub Copilot CLI\u0027s shell tool that could allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent (e.g., via prompt injection through repository files, MCP server responses, or user instructions) can exploit bash parameter transformation operators to execute hidden commands, bypassing the safety assessment that classifies commands as \"read-only.\"\n\n## Details\n\nThe vulnerability stems from how the CLI\u0027s shell safety assessment evaluates commands before execution. The safety layer parses and classifies shell commands as either read-only (safe) or write-capable (requires user approval). However, several bash parameter expansion features can embed executable code within arguments to otherwise read-only commands, causing them to appear safe while actually performing arbitrary operations.\n\nThe specific dangerous patterns are:\n\n1. **`${var@P}` \u2014 Prompt expansion:** The `@P` parameter transformation operator evaluates its value as a prompt string, which interprets embedded command substitutions. This allows hidden command execution inside what appears to be a simple variable reference.\n\n2. **`${var=value}` / `${var:=value}` \u2014 Assignment side-effects:** These forms assign values to variables as a side-effect of expansion. When chained with `@P`, an attacker can progressively build up a command substitution string across multiple expansions.\n\n3. **`${!var}` \u2014 Indirect expansion:** Dereferences an arbitrary variable name, which can be combined with other patterns to construct and execute commands dynamically.\n\n4. **Nested `$(cmd)` or `\u003c(cmd)` inside `${...}` expansions:** Command substitution or process substitution embedded within parameter expansion default values (e.g., `${HOME:-$(whoami)}`) executes the nested command.\n\n### Proof of Concept\n\nThe following command appears to run a harmless `echo`, but actually executes `touch /tmp/pwned` through chained parameter expansion:\n\n```bash\necho ${a=\"$\"}${b=\"$a(touch /tmp/pwned)\"}${b@P}\n```\n\n**How it works:**\n- `${a=\"$\"}` assigns the literal `$` character to variable `a`\n- `${b=\"$a(touch /tmp/pwned)\"}` expands `$a` to `$`, constructing the string `$(touch /tmp/pwned)` and assigning it to `b`\n- `${b@P}` applies prompt expansion to `b`, which evaluates the embedded `$(touch /tmp/pwned)` command substitution\n\nPrior to the fix, the safety assessment would classify `echo` as a read-only command and allow execution without user confirmation \u2014 even in modes that normally require approval for write operations.\n\n## Impact\n\nAn attacker who can influence command text sent to the shell tool \u2014 for example, through:\n- Prompt injection via malicious repository content (README files, code comments, issue bodies)\n- Compromised or malicious MCP server responses\n- Crafted user instructions containing obfuscated commands\n\n\u2014 could achieve arbitrary code execution on the user\u0027s workstation. This is possible even in permission modes that require user approval for write operations, since the commands can appear to be using only read-only utilities to ultimately trigger write operations.\n\nSuccessful exploitation could lead to data exfiltration, file modification, or further system compromise.\n\n## Affected Versions\n\n- GitHub Copilot CLI versions prior to 0.0.423\n\n## Remediation and Mitigation\n\n### Fix\n\nThe fix adds two layers of defense:\n\n1. **Parse-time detection:** The shell safety assessment analyzes `${...}` expansion nodes within bash commands, detecting dangerous operators (`@P`, `=`, `:=`, `!`) and nested command/process substitutions. Commands containing these patterns are downgraded from read-only to write-capable, ensuring they require user approval.\n\n2. **Unconditional blocking:** Commands with dangerous expansion patterns are unconditionally blocked at the tool execution layer \u2014 regardless of permission mode (including `--yolo` / autopilot). This prevents exploitation even when all commands are auto-approved.\n\n3. **System prompt hardening:** The bash shell tool\u0027s system prompt now includes explicit instructions for the LLM to refuse executing commands with these patterns, providing a defense-in-depth layer.\n\n### User Actions\n\n1. **Upgrade** GitHub Copilot CLI to **0.0.423** or later.\n2. **Exercise caution** when working in untrusted repositories or with untrusted MCP servers.\n3. **Review** any shell commands suggested by the agent that contain complex parameter expansion patterns.",
  "id": "GHSA-g8r9-g2v8-jv6f",
  "modified": "2026-03-06T22:44:18Z",
  "published": "2026-03-06T16:43:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/github/copilot-cli/security/advisories/GHSA-g8r9-g2v8-jv6f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29783"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/github/copilot-cli"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/copilot-cli/releases/tag/v0.0.423"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-29783 (GCVE-0-2026-29783)

GHSA-G8R9-G2V8-JV6F

Summary

Details

Proof of Concept

Impact

Affected Versions

Remediation and Mitigation

Fix

User Actions

Tags

Sightings

Nomenclature