Executive brief
GitHub Copilot CLI is a tool that allows users to run shell commands generated by AI. A vulnerability in its safety filter allows malicious actors to hide dangerous commands inside what appear to be harmless, 'read-only' instructions. If a user is tricked into running a suggested command—potentially through malicious code comments or repository files—an attacker could execute arbitrary code on the user's computer, leading to data theft or system compromise.
Technical details
The GitHub Copilot CLI shell tool fails to properly sanitize bash parameter expansion patterns, allowing for command injection. The safety layer classifies commands as 'read-only' or 'write-capable,' but specific bash features like prompt expansion (${var@P}), assignment side-effects (${var=value}), and indirect expansion (${!var}) can be used to embed executable code within arguments that appear safe. An attacker can exploit this via prompt injection (e.g., malicious README files or MCP server responses) to execute arbitrary commands on the user's workstation, even when the CLI is in a mode that requires approval for write operations. The vulnerability is addressed in version 0.0.423 by implementing parse-time detection of dangerous operators and unconditionally blocking commands containing these patterns.
Affected products
- GitHub Copilot CLI <= 0.0.422
Timeline
- 2026-03-06: disclosed
- 2026-03-06: patched: Fixed in version 0.0.423
- 2026-03-06: advisory