CVE-2026-29783

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29783", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-04T16:26:02.898Z", "datePublished": "2026-03-06T16:39:27.424Z", "dateUpdated": "2026-11-03T22:13:23.016Z"}, "containers": {"cna": {"title": "GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/github/copilot-cli/security/advisories/GHSA-g8r9-g2v8-jv6f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/github/copilot-cli/security/advisories/GHSA-g8r9-g2v8-jv6f"}, {"name": "https://github.com/github/copilot-cli/releases/tag/v0.0.423", "tags": ["x_refsource_MISC"], "url": "https://github.com/github/copilot-cli/releases/tag/v0.0.423"}], "affected": [{"vendor": "github", "product": "copilot-cli", "versions": [{"version": "<= 0.0.422", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T16:50:41.728Z"}, "descriptions": [{"lang": "en", "value": "The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent (e.g., via prompt injection through repository files, MCP server responses, or user instructions) can exploit bash parameter transformation operators to execute hidden commands, bypassing the safety assessment that classifies commands as \"read-only.\" This has been patched in version 0.0.423. \n\nThe vulnerability stems from how the CLI's shell safety assessment evaluates commands before execution. The safety layer parses and classifies shell commands as either read-only (safe) or write-capable (requires user approval). However, several bash parameter expansion features can embed executable code within arguments to otherwise read-only commands, causing them to appear safe while actually performing arbitrary operations.\n\nThe specific dangerous patterns are ${var@P}, ${var=value} / ${var:=value}, ${!var}, and nested $(cmd) or <(cmd) inside ${...} expansions. An attacker who can influence command text sent to the shell tool - for example, through prompt injection via malicious repository content (README files, code comments, issue bodies), compromised or malicious MCP server responses, or crafted user instructions containing obfuscated commands - could achieve arbitrary code execution on the user's workstation. This is possible even in permission modes that require user approval for write operations, since the commands can appear to use only read-only utilities to ultimately trigger write operations. Successful exploitation could lead to data exfiltration, file modification, or further system compromise."}], "source": {"advisory": "GHSA-g8r9-g2v8-jv6f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29783", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T03:56:38.865465Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T22:13:23.016Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29783", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T03:56:38.865465Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:05:55.613Z"}}], "cna": {"title": "GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command execution", "source": {"advisory": "GHSA-g8r9-g2v8-jv6f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "github", "product": "copilot-cli", "versions": [{"status": "affected", "version": "<= 0.0.422"}]}], "references": [{"url": "https://github.com/github/copilot-cli/security/advisories/GHSA-g8r9-g2v8-jv6f", "name": "https://github.com/github/copilot-cli/security/advisories/GHSA-g8r9-g2v8-jv6f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/github/copilot-cli/releases/tag/v0.0.423", "name": "https://github.com/github/copilot-cli/releases/tag/v0.0.423", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent (e.g., via prompt injection through repository files, MCP server responses, or user instructions) can exploit bash parameter transformation operators to execute hidden commands, bypassing the safety assessment that classifies commands as \"read-only.\" This has been patched in version 0.0.423. \n\nThe vulnerability stems from how the CLI's shell safety assessment evaluates commands before execution. The safety layer parses and classifies shell commands as either read-only (safe) or write-capable (requires user approval). However, several bash parameter expansion features can embed executable code within arguments to otherwise read-only commands, causing them to appear safe while actually performing arbitrary operations.\n\nThe specific dangerous patterns are ${var@P}, ${var=value} / ${var:=value}, ${!var}, and nested $(cmd) or <(cmd) inside ${...} expansions. An attacker who can influence command text sent to the shell tool - for example, through prompt injection via malicious repository content (README files, code comments, issue bodies), compromised or malicious MCP server responses, or crafted user instructions containing obfuscated commands - could achieve arbitrary code execution on the user's workstation. This is possible even in permission modes that require user approval for write operations, since the commands can appear to use only read-only utilities to ultimately trigger write operations. Successful exploitation could lead to data exfiltration, file modification, or further system compromise."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T16:50:41.728Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29783", "state": "PUBLISHED", "dateUpdated": "2026-11-03T22:13:23.016Z", "dateReserved": "2026-03-04T16:26:02.898Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T16:39:27.424Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "copilot-cli", "vendor": "github", "versions": [{"status": "affected", "version": "<= 0.0.422"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:github:copilot_command_line_interface:*:*:*:*:*:*:*:*", "matchCriteriaId": "83686E02-90BA-4DD7-96D1-37799C3B04CE", "versionEndExcluding": "0.0.423", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent (e.g., via prompt injection through repository files, MCP server responses, or user instructions) can exploit bash parameter transformation operators to execute hidden commands, bypassing the safety assessment that classifies commands as \"read-only.\" This has been patched in version 0.0.423. \n\nThe vulnerability stems from how the CLI's shell safety assessment evaluates commands before execution. The safety layer parses and classifies shell commands as either read-only (safe) or write-capable (requires user approval). However, several bash parameter expansion features can embed executable code within arguments to otherwise read-only commands, causing them to appear safe while actually performing arbitrary operations.\n\nThe specific dangerous patterns are ${var@P}, ${var=value} / ${var:=value}, ${!var}, and nested $(cmd) or <(cmd) inside ${...} expansions. An attacker who can influence command text sent to the shell tool - for example, through prompt injection via malicious repository content (README files, code comments, issue bodies), compromised or malicious MCP server responses, or crafted user instructions containing obfuscated commands - could achieve arbitrary code execution on the user's workstation. This is possible even in permission modes that require user approval for write operations, since the commands can appear to use only read-only utilities to ultimately trigger write operations. Successful exploitation could lead to data exfiltration, file modification, or further system compromise."}, {"lang": "es", "value": "La herramienta de shell en las versiones de GitHub Copilot CLI anteriores e incluyendo la 0.0.422 puede permitir la ejecuci\u00f3n de c\u00f3digo arbitrario a trav\u00e9s de patrones de expansi\u00f3n de par\u00e1metros de bash manipulados. Un atacante que puede influir en los comandos ejecutados por el agente (por ejemplo, a trav\u00e9s de inyecci\u00f3n de prompt mediante archivos de repositorio, respuestas del servidor MCP o instrucciones del usuario) puede explotar los operadores de transformaci\u00f3n de par\u00e1metros de bash para ejecutar comandos ocultos, eludiendo la evaluaci\u00f3n de seguridad que clasifica los comandos como 'solo lectura'. Esto ha sido parcheado en la versi\u00f3n 0.0.423.\n\nLa vulnerabilidad se deriva de c\u00f3mo la evaluaci\u00f3n de seguridad de shell de la CLI eval\u00faa los comandos antes de la ejecuci\u00f3n. La capa de seguridad analiza y clasifica los comandos de shell como de solo lectura (seguros) o con capacidad de escritura (requiere aprobaci\u00f3n del usuario). Sin embargo, varias caracter\u00edsticas de expansi\u00f3n de par\u00e1metros de bash pueden incrustar c\u00f3digo ejecutable dentro de argumentos de comandos que de otro modo ser\u00edan de solo lectura, haciendo que parezcan seguros mientras que en realidad realizan operaciones arbitrarias.\n\nLos patrones peligrosos espec\u00edficos son ${var@P}, ${var=value} / ${var:=value}, ${!var}, y $(cmd) o &lt;(cmd) anidados dentro de expansiones ${...}. Un atacante que puede influir en el texto de comando enviado a la herramienta de shell - por ejemplo, a trav\u00e9s de inyecci\u00f3n de prompt mediante contenido de repositorio malicioso (archivos README, comentarios de c\u00f3digo, cuerpos de incidencias), respuestas de servidor MCP comprometidas o maliciosas, o instrucciones de usuario manipuladas que contengan comandos ofuscados - podr\u00eda lograr ejecuci\u00f3n de c\u00f3digo arbitrario en la estaci\u00f3n de trabajo del usuario. Esto es posible incluso en modos de permiso que requieren la aprobaci\u00f3n del usuario para operaciones de escritura, ya que los comandos pueden parecer usar solo utilidades de solo lectura para finalmente desencadenar operaciones de escritura. La explotaci\u00f3n exitosa podr\u00eda conducir a la exfiltraci\u00f3n de datos, modificaci\u00f3n de archivos o un compromiso adicional del sistema."}], "id": "CVE-2026-29783", "lastModified": "2026-11-03T23:17:41.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29783", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T03:56:38.865465Z", "version": "2.0.3"}}]}, "published": "2026-03-06T17:16:35.487", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/github/copilot-cli/releases/tag/v0.0.423"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/github/copilot-cli/security/advisories/GHSA-g8r9-g2v8-jv6f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.0.422]"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "copilot-cli", "source": "cna", "vendor": "github"}, "product": "copilot", "vendor": "github"}], "analysis": {"en": {"generated_at": "2026-04-16T11:19:19.456515+00:00", "value": {"mitigation_remediation": ["Update GitHub Copilot CLI to version 0.0.423 or newer to remove the shell safety flaw", "If upgrading immediately is not possible, block or disable the shell execution feature in the CLI configuration to prevent any command execution", "Regularly review repository content and prompt logs for potential injection attempts and enforce strict code\u2011review policies to minimize malicious input"], "summary": {"action": "Immediate Patch", "impact": "Arbitrary Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects GitHub Copilot CLI versions up to and including 0.0.422. The affected product is the GitHub Copilot CLI itself, distributed by GitHub under the open source project name copilot-cli.", "description_and_impact": "GitHub Copilot CLI includes a shell tool that evaluates commands for safety before running them. This is a command\u2011injection vulnerability (CWE\u201178). The assessment incorrectly classifies commands that contain certain bash parameter expansion patterns\u2014such as ${var@P}, ${var=value}, ${!var}, and nested $(cmd) or <(cmd) inside ${\u2026}\u2014as safe read\u2011only. An attacker who can influence the text sent to the shell (for instance, via prompt injection through repository files, malicious MCP server responses, or crafted user instructions) can embed executable code that the safety layer fails to detect, leading to arbitrary command execution on the user\u2019s workstation. This can result in data exfiltration, file modification, or full system compromise.", "risk_and_exploitability": "The CVSS score of 7.5 indicates high severity. The EPSS score is below 1%, suggesting that while exploitation is unlikely at this moment, the potential impact is significant. The vulnerability is not listed in the CISA KEV catalog. An attacker who can supply malicious input to the shell tool\u2014through repository content or prompt injection\u2014can execute arbitrary code without requiring write permissions, as the attack bypasses the safety assessment that would normally flag non\u2011read\u2011only operations. No patch is available in older releases, meaning the risk persists until the user upgrades or mitigates the exposed input vectors."}}}}, "created": "2026-03-09T10:07:18.120567+00:00", "updated": "2026-04-16T11:30:15.899363+00:00", "vendors": ["github", "github$PRODUCT$copilot"]}