Incorrect behavior order in GitHub Copilot CLI - CVE-2026-45033

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU139894

Incorrect behavior order in GitHub Copilot CLI - CVE-2026-45033

Published: July 28, 2026


Vulnerability identifier: #VU139894
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45033
CWE-ID: CWE-696
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary commands.

The vulnerability exists due to incorrect behavior order in git operations when processing a project directory containing a nested bare git repository with executable configuration keys. A remote attacker can place a malicious bare repository inside a project to execute arbitrary commands.

User interaction is required in that GitHub Copilot CLI must perform git operations in or near the malicious directory.


Affected software

GitHub Copilot CLI
Bob

How to mitigate CVE-2026-45033

Install security update from vendor's website.

GitHub Copilot CLI - update to 1.0.43
Bob - update to 2.0

External References

Related Security Bulletins