GitHub Copilot CLI includes a shell tool that evaluates commands for safety before running them. This is a command‑injection vulnerability (CWE‑78). The assessment incorrectly classifies commands that contain certain bash parameter expansion patterns—such as ${var@P}, ${var=value}, ${!var}, and nested $(cmd) or <(cmd) inside ${…}—as safe read‑only. An attacker who can influence the text sent to the shell (for instance, via prompt injection through repository files, malicious MCP server responses, or crafted user instructions) can embed executable code that the safety layer fails to detect, leading to arbitrary command execution on the user’s workstation. This can result in data exfiltration, file modification, or full system compromise.

The vulnerability affects GitHub Copilot CLI versions up to and including 0.0.422. The affected product is the GitHub Copilot CLI itself, distributed by GitHub under the open source project name copilot-cli.

The CVSS score of 7.5 indicates high severity. The EPSS score is below 1%, suggesting that while exploitation is unlikely at this moment, the potential impact is significant. The vulnerability is not listed in the CISA KEV catalog. An attacker who can supply malicious input to the shell tool—through repository content or prompt injection—can execute arbitrary code without requiring write permissions, as the attack bypasses the safety assessment that would normally flag non‑read‑only operations. No patch is available in older releases, meaning the risk persists until the user upgrades or mitigates the exposed input vectors.