OS Command Injection in GitHub Copilot CLI - CVE-2026-29783
Published: July 28, 2026
Vulnerability identifier: #VU139895
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2026-29783
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: GitHub
Affected software:
GitHub Copilot CLI
GitHub Copilot CLI
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements used in an os command in the shell safety assessment of the shell tool when evaluating crafted bash parameter expansion patterns in command text. A remote attacker can influence commands executed by the agent to execute arbitrary code.
User interaction is required to execute the influenced command.
How to mitigate CVE-2026-29783
Install security update from vendor's website.