CVE-2026-29783: GitHub Copilot CLI RCE Vulnerability

CVE-2026-29783 Overview

A command injection vulnerability exists in GitHub Copilot CLI versions 0.0.422 and earlier that allows arbitrary code execution through crafted bash parameter expansion patterns. The vulnerability resides in the shell tool's safety assessment mechanism, which fails to properly evaluate certain bash parameter transformation operators that can embed executable code within seemingly read-only commands.

An attacker who can influence the commands executed by the Copilot CLI agent—through prompt injection via malicious repository files (README files, code comments, issue bodies), compromised MCP server responses, or crafted user instructions containing obfuscated commands—can exploit this flaw to execute arbitrary commands on the user's workstation. This bypass is particularly dangerous because it circumvents the safety layer that normally requires user approval for write operations.

Critical Impact

Attackers can achieve arbitrary code execution on developer workstations by injecting malicious bash parameter expansion patterns that appear safe but execute hidden commands, potentially leading to data exfiltration, file modification, or complete system compromise.

Affected Products

• GitHub Copilot CLI versions 0.0.422 and earlier
• Systems using GitHub Copilot CLI shell tool with bash parameter expansion capabilities

Discovery Timeline

• 2026-03-06 - CVE CVE-2026-29783 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-29783

Vulnerability Analysis

This command injection vulnerability (CWE-78) exploits a fundamental weakness in how the Copilot CLI's shell safety assessment evaluates commands before execution. The safety layer parses and classifies shell commands as either read-only (safe) or write-capable (requires user approval). However, the assessment fails to account for several bash parameter expansion features that can embed executable code within arguments to otherwise read-only commands.

The vulnerability allows commands that appear to use only read-only utilities to ultimately trigger write operations, completely bypassing the intended security controls. This represents a significant trust boundary violation in AI-assisted developer tooling.

Root Cause

The root cause lies in insufficient parsing of bash parameter expansion syntax within the shell tool's command safety classifier. The safety assessment treats expanded parameters as static values rather than recognizing that certain expansion patterns can execute arbitrary code during parameter evaluation.

The specific dangerous patterns that bypass the safety check include:

• ${var@P} - Prompt expansion operator that can execute embedded commands
• ${var=value} and ${var:=value} - Assignment operators that can contain command substitutions
• ${!var} - Indirect expansion that can reference variables containing commands
• Nested $(cmd) or <(cmd) constructs inside ${...} expansions

These patterns allow an attacker to craft commands that the safety layer classifies as read-only while actually embedding malicious code execution.

Attack Vector

The attack can be delivered through multiple vectors that influence the text processed by the Copilot CLI shell tool:

Prompt Injection via Repository Content: Malicious actors can embed obfuscated bash parameter expansion patterns in README files, code comments, or issue bodies within repositories. When a developer uses Copilot CLI to interact with these repositories, the injected patterns may be processed and executed.

Compromised MCP Server Responses: If the Model Context Protocol (MCP) server returns malicious content, the crafted bash expansion patterns can be included in suggested commands.

Crafted User Instructions: Social engineering attacks can trick users into executing commands that contain hidden malicious parameter expansions that appear benign to both the user and the safety assessment layer.

The network-accessible nature of this attack combined with the potential for user interaction through legitimate developer workflows makes this a practical exploitation scenario.

Detection Methods for CVE-2026-29783

Indicators of Compromise

• Unusual bash parameter expansion patterns in shell history, particularly ${var@P}, ${var=value}, or ${!var} constructs
• Unexpected process spawning from Copilot CLI execution contexts
• Shell commands containing nested $(...) or <(...) within parameter expansions
• Evidence of data exfiltration or unauthorized file modifications following Copilot CLI usage

Detection Strategies

• Monitor shell command execution logs for suspicious bash parameter expansion patterns that combine read-only utilities with complex variable expansions
• Implement behavioral analysis to detect unexpected child process creation from Copilot CLI processes
• Deploy endpoint detection rules that flag unusual parameter transformation operators in shell commands

Monitoring Recommendations

• Enable detailed shell command logging on developer workstations using Copilot CLI
• Configure SIEM alerts for patterns matching known bash parameter expansion exploitation techniques
• Monitor network traffic from developer endpoints for unexpected outbound connections during Copilot CLI usage

How to Mitigate CVE-2026-29783

Immediate Actions Required

• Upgrade GitHub Copilot CLI to version 0.0.423 or later immediately
• Review shell command history for evidence of exploitation attempts
• Audit repositories and MCP server configurations for potential prompt injection vectors
• Consider temporarily disabling Copilot CLI shell tool functionality until patching is complete

Patch Information

GitHub has addressed this vulnerability in Copilot CLI version 0.0.423. The patch enhances the shell safety assessment to properly detect and block dangerous bash parameter expansion patterns before command execution.

For detailed patch information, refer to the GitHub Copilot CLI Release v0.0.423 and the GitHub Security Advisory GHSA-g8r9-g2v8-jv6f.

Workarounds

• Disable the Copilot CLI shell tool until the update can be applied
• Implement strict input validation for any content processed by Copilot CLI, particularly repository content
• Run Copilot CLI in isolated environments or containers with limited system access
• Configure additional approval requirements for all shell commands, not just those classified as write operations

# Verify current Copilot CLI version and upgrade
# Check installed version
copilot --version

# Update to patched version via npm
npm update -g @github/copilot-cli

# Verify upgrade was successful
copilot --version
# Should show 0.0.423 or higher