Arbitrary Code Execution Vulnerability in GitHub Copilot CLI

CVE-2026-45033

What is CVE-2026-45033?

A security flaw exists in GitHub Copilot CLI that allows for arbitrary code execution through the exploitation of malicious bare git repositories. Prior to version 1.0.43, when users execute git operations, the CLI could inadvertently run commands specified by attackers via git's automatic bare repository discovery feature. This occurs during directory traversal, allowing the attacker to configure executable keys such as core.fsmonitor, which can trigger unauthorized commands without user consent. This defect poses a significant risk as it can be exploited during normal git operations like status, diff, or rev-parse, leading to potential system compromise.

References