No prompt. No click. No approval dialog. Just git status.
What the source says
GitHub published a security advisory (GHSA-9ccr-r5hg-74gf, CVE-2026-45033, credited to researcher syvb) disclosing that GitHub Copilot CLI could be made to execute arbitrary commands through a nested bare git repository. Git automatically discovers bare repositories while walking a directory tree and applies their configuration — including core.fsmonitor, a setting whose value is a program git runs on its own whenever a routine operation like git status or git diff refreshes the index.
An attacker who could get a bare repository planted somewhere inside a project (say, vendor/malicious.git/ — via a pull request, a compromised dependency, or any tree Copilot CLI happened to be pointed at) could set core.fsmonitor to an arbitrary command. That command would run the moment Copilot CLI performed one of the background git operations it issues on its own while working in the directory — no user interaction of any kind required.
The advisory rates the flaw CVSS 8.5 (High; AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H), affecting @github/copilot versions up to and including 1.0.42. GitHub fixed it in 1.0.43 by setting safe.bareRepository=explicit, which disables git's automatic bare-repository discovery outright.
What it doesn't establish
This is GitHub's own advisory for GitHub's own product — about as primary a source as this database sees, and it's already fixed. It doesn't tell us how the vulnerable code path was introduced, whether it was caught by internal review or external report timing alone, or how many installs were running an affected version before 1.0.43 shipped. The advisory also doesn't claim any in-the-wild exploitation; this is a disclosed-and-patched flaw, not a confirmed incident with a victim.
The advisory does note the underlying core.fsmonitor-via-background-git-ops pattern was later reported to affect other AI coding agents too — but this write-up covers only what GitHub disclosed about Copilot CLI specifically, not those other reports.
Why it's worth tracking anyway
This is the fourth GitHub Copilot security-vulnerability entry in this database's corpus, and it's mechanically distinct from the other three: hidden-Unicode prompt injection turning Copilot and Cursor into malicious-code emitters (Rule Files Backdoor), Copilot suggesting thousands of real leaked credentials as autocomplete, and CamoLeak's prompt-injection exfiltration channel via Copilot Chat (CVSS 9.6) were all attacks on what the model generates or reads. This one attacks Copilot CLI's own background tooling behavior — the git commands it runs unprompted while doing its job. Zero model reasoning is involved; the flaw exists entirely in the gap between "an agentic CLI needs to run git operations to stay useful" and "git will execute arbitrary configuration it finds lying in the directory tree." That gap doesn't go away with a smarter model — it needs the same kind of fix GitHub actually shipped: narrowing what the tool trusts by default.
Top comments (0)