GHSA-g8r9-g2v8-jv6f: GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution

Summary

GitHub Copilot CLI's shell tool contains a vulnerability in which crafted bash parameter expansion patterns (such as ${var@P}, assignment forms like ${var=value}, indirect ${!var}, and nested $(cmd) inside ${...}) can hide command execution inside commands the safety assessment classifies as read-only. An attacker who can influence the commands the agent runs, for example through prompt injection in repository files, MCP server responses, or user instructions, could achieve arbitrary code execution on the user's workstation, even in modes that require approval for write operations. The issue affects versions prior to 0.0.423.

Mitigation

Fixed in 0.0.423. The fix adds parse-time detection that downgrades commands containing dangerous ${...} expansion operators or nested command/process substitutions from read-only to write-capable, and unconditionally blocks such commands at the tool execution layer regardless of permission mode, including --yolo / autopilot.

Topics

• Coding assistants
• Model Context Protocol

Related items

• HighCVE-2026-108456 Azure AI Foundry Elevation of Privilege VulnerabilitySame vendor · MSRC Security Update Guide
• HighGHSA-h4xc-3qfq-jf93: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpointSame vendor · GitHub Advisory Database
• LowGHSA-6gw6-rv2g-25mg: Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifestsSame vendor · GitHub Advisory Database
• MediumCVE-2026-89278: GPTranslate WordPress plugin exposes plaintext API key to unauthenticated usersSame vendor · NVD/CVE Database
• HighCVE-2026-85887: M365 Copilot incorrect permission assignment allows information disclosureSame vendor · NVD/CVE Database