{"data":{"id":"ed595d01-a8b0-4c0c-86bb-0ffe61b00cd7","title":"GHSA-g8r9-g2v8-jv6f: GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution","summary":"GitHub Copilot CLI's shell tool contains a vulnerability in which crafted bash parameter expansion patterns (such as ${var@P}, assignment forms like ${var=value}, indirect ${!var}, and nested $(cmd) inside ${...}) can hide command execution inside commands the safety assessment classifies as read-only. An attacker who can influence the commands the agent runs, for example through prompt injection in repository files, MCP server responses, or user instructions, could achieve arbitrary code execution on the user's workstation, even in modes that require approval for write operations. The issue affects versions prior to 0.0.423.","solution":"Fixed in 0.0.423. The fix adds parse-time detection that downgrades commands containing dangerous ${...} expansion operators or nested command/process substitutions from read-only to write-capable, and unconditionally blocks such commands at the tool execution layer regardless of permission mode, including --yolo / autopilot.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-g8r9-g2v8-jv6f","publishedAt":"2026-03-06T16:43:31.000Z","cveId":"CVE-2026-29783","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["@github/copilot@<= 0.0.422 (fixed: 0.0.423)"],"affectedPackageNames":["@github/copilot"],"affectedPackageRefs":["npm:@github/copilot"],"affectedVendors":["Microsoft"],"affectedVendorsRaw":["GitHub Copilot CLI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00468,"epssCheckedAt":"2026-11-04T00:12:27.299Z","kevDateAdded":null,"advisoryAliases":["GHSA-g8r9-g2v8-jv6f"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-03-06T15:41:23.814Z","daysToFix":0,"fixCheckedAt":"2026-10-29T21:40:09.957Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"npm","name":"@github/copilot","fixedVersion":"0.0.423","matchedVersion":"0.0.423","fixReleasedAt":"2026-03-06T15:41:23.814Z","daysToFix":0,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:09.808Z"}]}}