CVE-2026-45033

GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor

Published May 13, 2026 CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Description

GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory traversal, an attacker can set core.fsmonitor or other executable config keys to run arbitrary commands without user awareness or approval. The vulnerability arises because git's core.fsmonitor config key (and 15+ similar keys such as core.hookspath, diff.external, merge.tool, etc.) can specify arbitrary shell commands that git will execute as part of normal operations like status, diff, or rev-parse. This vulnerability is fixed in 1.0.43.

Analysis

Technical impact

The vulnerability arises when GitHub Copilot CLI discovers a malicious nested bare Git repository and unintentionally executes arbitrary shell commands specified in configuration keys such as core.fsmonitor. This flaw, classified under CWE‑696, enables an attacker to run any command during regular Git operations like status or diff, potentially leading to full code execution without user approval.

Affected Systems

GitHub Copilot CLI versions before 1.0.43 are affected. Any installation of the CLI that allows a user or process to create or modify nested bare repositories inside a workspace is at risk.

Risk and Exploitability

With a CVSS score of 8.5, the vulnerability is considered high severity. Although the EPSS score is not available, the direct exploitation path—placing a bare repository with malicious config keys—is straightforward for users with write access to the repository’s directory. The flaw is not currently listed in the CISA KEV catalog, but its high impact and ease of exploitation suggest that it could be leveraged in both local and service contexts where the CLI runs with elevated privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

github

copilot-cli

affected

Version	Status	Constraints
`< 1.0.43`	affected	—

Configuration 1 [-]

cpe:2.3:a:github:copilot-cli:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Github

Copilot

Version	Status	Scheme	Platform
`[0,1.0.43)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade GitHub Copilot CLI to version 1.0.43 or later.
Disable or remove any Git configuration keys that allow arbitrary command execution, such as core.fsmonitor, core.hookspath, diff.external, merge.tool, and the 15 other similar keys, in all affected repositories.
Ensure that no nested bare repositories are present in the project directories accessed by the CLI, or restrict write access to those directories to trusted users only.

Generated by OpenCVE AI on May 13, 2026 at 17:30 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-9ccr-r5hg-74gf	GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.350% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/github/copilot-cli/security/advisories/GHSA-9ccr-r5hg-74gf

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 2, 2026 2:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Github copilot-cli
CPEs		cpe:2.3:a:github:copilot-cli::::::::
Vendors & Products		Github copilot-cli
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

May 14, 2026 2:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Github Github copilot
Vendors & Products		Github Github copilot

May 13, 2026 4:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory traversal, an attacker can set core.fsmonitor or other executable config keys to run arbitrary commands without user awareness or approval. The vulnerability arises because git's core.fsmonitor config key (and 15+ similar keys such as core.hookspath, diff.external, merge.tool, etc.) can specify arbitrary shell commands that git will execute as part of normal operations like status, diff, or rev-parse. This vulnerability is fixed in 1.0.43.
Title		GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor
Weaknesses		CWE-696
References		https://github.com/github/copilot-cli/security/advisories/GHSA-9ccr-r5hg-74gf
Metrics		cvssV4_0 `{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`