PT-2026-39901 · Github · Github Copilot Cli

Syvb · Published 2026-05-11 · Updated 2026-06-02 · CVE-2026-45033

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GitHub Copilot CLI versions prior to 1.0.43

Description An issue exists where a malicious bare git repository nested inside a project directory can lead to arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory traversal, an attacker can configure executable keys to run arbitrary commands without user awareness or approval. This occurs because certain git configuration keys, such as core.fsmonitor, core.hookspath, diff.external, and merge.tool, can specify shell commands that git executes during normal operations like status, diff, or rev-parse.

Recommendations Update GitHub Copilot CLI to version 1.0.43 or later. Exercise caution when working in repositories that contain nested bare git repositories. Review project directories for unexpected bare repositories, especially in vendor/, third party/, or deeply nested subdirectories.

Exploit

Fix

Weakness Enumeration

CWE-696

Related Identifiers

CVE-2026-45033

GHSA-9CCR-R5HG-74GF

Affected Products

Github Copilot Cli

References · 6

• 🔥 https://github.com/github/copilot-cli/security/advisories/GHSA-9ccr-r5hg-74gf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45033 · Security Note
• https://osv.dev/vulnerability/GHSA-9ccr-r5hg-74gf · Vendor Advisory
• https://github.com/github/copilot-cli · Note
• https://t.me/cveNotify/165631 · Telegram Post
• https://t.me/CVEtracker/53674 · Telegram Post