{"data":{"id":"bcd6d212-9ff2-4941-acad-4ec698b8639e","title":"CVE-2026-45033: GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security…","summary":"A flaw in GitHub Copilot CLI before 1.0.43 allows arbitrary code execution when the agent runs git operations inside a project containing a malicious nested bare git repository. Git's automatic bare repository discovery during directory traversal lets an attacker set core.fsmonitor or other executable config keys, such as core.hookspath, diff.external and merge.tool, which git runs during status, diff or rev-parse without user awareness or approval.","solution":"Fixed in 1.0.43.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45033","publishedAt":"2026-05-13T16:17:00.313Z","cveId":"CVE-2026-45033","cweIds":["CWE-696"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@github/copilot@<= 1.0.42 (fixed: 1.0.43)"],"affectedPackageNames":["@github/copilot"],"affectedPackageRefs":["npm:@github/copilot"],"affectedVendors":["Microsoft"],"affectedVendorsRaw":["GitHub Copilot CLI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"GitHub Copilot CLI code execution via nested malicious bare git repository","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00384,"epssCheckedAt":"2026-10-15T12:09:09.659Z","kevDateAdded":null,"advisoryAliases":["GHSA-9ccr-r5hg-74gf"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:23.337Z","patchAvailable":true,"disclosureDate":"2026-05-13T16:17:00.313Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}