OS Command Injection in GitHub Copilot CLI - CVE-2026-29783
Published: July 28, 2026
Vulnerability identifier: #VU139895
CSH Severity: High
CVSS v4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-29783
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements used in an os command in the shell safety assessment of the shell tool when evaluating crafted bash parameter expansion patterns in command text. A remote attacker can influence commands executed by the agent to execute arbitrary code.
User interaction is required to execute the influenced command.
Affected software
GitHub Copilot CLI
How to mitigate CVE-2026-29783
Install security update from vendor's website.
GitHub Copilot CLI - update to 0.0.423