GHSA-g8r9-g2v8-jv6f
NoneCVSS
—
EPSS
—
Published
Mar 6, 2026
CISA due date
—
The record
GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @github/copilot | 0 | 0.0.423 |
Related vulnerabilities
- CVE-2026-29783 The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can… Same vulnerability
- CVE-2026-45033 GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Also affects @github/copilot
- GHSA-9ccr-r5hg-74gf GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via… Also affects @github/copilot
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-78