Is CVE-2026-29783 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29783 being exploited in the wild.

How severe is CVE-2026-29783?

High severity, with a CVSS score of 7.8, published 6 March 2026.

Which products and versions are affected?

GitHub Copilot CLI <= 0.0.422; @github/copilot (npm) SEMVER:introduced=0,fixed=0.0.423.

Is there a fix for CVE-2026-29783?

Yes. @github/copilot (npm): upgrade to 0.0.423 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-29783 attacked?

It is attacked over the network or with local access, in a network appliance.

Am I affected by CVE-2026-29783?

Check whether you run GitHub Copilot CLI, GitHub Copilot Command Line Interface or @github/copilot (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29783: GitHub Copilot CLI arbitrary code execution via bash parameter expansion

Q: Which products and versions are affected?

GitHub Copilot CLI <= 0.0.422; @github/copilot (npm) SEMVER:introduced=0,fixed=0.0.423.

Q: Is there a fix for CVE-2026-29783?

Yes. @github/copilot (npm): upgrade to 0.0.423 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-29783 attacked?

It is attacked over the network or with local access, in a network appliance.

Q: Am I affected by CVE-2026-29783?

Check whether you run GitHub Copilot CLI, GitHub Copilot Command Line Interface or @github/copilot (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29783 · Severity: high · CVSS 7.8 · Published 2026-03-06

GitHub Copilot CLI is a tool that allows users to run shell commands generated by AI. A vulnerability in its safety filter allows malicious actors to hide dangerous commands inside what appear to be harmless, 'read-only' instructions. If a user is tricked into running a suggested command—potentially through malicious code comments or repository files—an attacker could execute arbitrary code on the user's computer, leading to data theft or system compromise.

Vendors: GitHub, npm.

Quick answers

Is CVE-2026-29783 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29783 being exploited in the wild.
How severe is CVE-2026-29783?: High severity, with a CVSS score of 7.8, published 6 March 2026.
Which products and versions are affected?: GitHub Copilot CLI <= 0.0.422; @github/copilot (npm) SEMVER:introduced=0,fixed=0.0.423.
Is there a fix for CVE-2026-29783?: Yes. @github/copilot (npm): upgrade to 0.0.423 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29783 attacked?: It is attacked over the network or with local access, in a network appliance.
Am I affected by CVE-2026-29783?: Check whether you run GitHub Copilot CLI, GitHub Copilot Command Line Interface or @github/copilot (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@github/copilot (npm): upgrade to 0.0.423 or later
```
npm install @github/copilot@0.0.423
```

Technical details

The GitHub Copilot CLI shell tool fails to properly sanitize bash parameter expansion patterns, allowing for command injection. The safety layer classifies commands as 'read-only' or 'write-capable,' but specific bash features like prompt expansion (${var@P}), assignment side-effects (${var=value}), and indirect expansion (${!var}) can be used to embed executable code within arguments that appear safe. An attacker can exploit this via prompt injection (e.g., malicious README files or MCP server responses) to execute arbitrary commands on the user's workstation, even when the CLI is in a mode that requires approval for write operations. The vulnerability is addressed in version 0.0.423 by implementing parse-time detection of dangerous operators and unconditionally blocking commands containing these patterns.

Affected products

GitHub Copilot CLI <= 0.0.422

Identifiers

CVE-2026-29783
GHSA-g8r9-g2v8-jv6f

Timeline

2026-03-06: disclosed
2026-03-06: patched: Fixed in version 0.0.423
2026-03-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.