GHSA-9ccr-r5hg-74gf
High · 7.8CVSS
7.8
EPSS
—
Published
May 11, 2026
CISA due date
—
The record
GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @github/copilot | 0 | 1.0.43 |
Related vulnerabilities
- CVE-2026-45033 GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Same vulnerability
- CVE-2026-29783 The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can… Also affects @github/copilot
- GHSA-g8r9-g2v8-jv6f GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution Also affects @github/copilot
- CVE-2026-59305 Partition interceptor may be improperly added while sending message. CWE-696
- CVE-2026-68930 Russh is a Rust SSH client & server library. CWE-696
- CVE-2026-67217 cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in… CWE-696
- CVE-2026-56355 GNU Savannah Administration Savane through 3.17 uses untrusted data as part of… CWE-696
- CVE-2026-49317 Incorrect behavior order in the Infotainment / Digital Round display of the Indian… CWE-696