CVE-2026-45033

GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory traversal, an attacker can set core.fsmonitor or other executable config keys to run arbitrary commands without user awareness or approval. The vulnerability arises because git's core.fsmonitor config key (and 15+ similar keys such as core.hookspath, diff.external, merge.tool, etc.) can specify arbitrary shell commands that git will execute as part of normal operations like status, diff, or rev-parse. This vulnerability is fixed in 1.0.43.

• CWE-696

• https://github.com/github/copilot-cli/security/advisories/GHSA-9ccr-r5hg-74gfExploit, Mitigation, Vendor Advisory
• https://github.com/github/copilot-cli/security/advisories/GHSA-9ccr-r5hg-74gfExploit, Mitigation, Vendor Advisory

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45025WeGIA is a web manager for charitable institutions. In versi…6.8
• CVE-2026-45026WeGIA is a web manager for charitable institutions. In versi…6.8
• CVE-2026-45027WeGIA is a web manager for charitable institutions. In versi…5.9
• CVE-2026-45028Astro is a web framework. Astro versions prior to 6.1.10 use…6.1
• CVE-2026-4503IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allo…7.5
• CVE-2026-45031ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-45034PhpSpreadsheet is a pure PHP library for reading and writing…9.2
• CVE-2026-45035Tabby (formerly Terminus) is a highly configurable terminal …8.8
• CVE-2026-45036Tabby (formerly Terminus) is a highly configurable terminal …7
• CVE-2026-45037Tabby (formerly Terminus) is a highly configurable terminal …7.1
• CVE-2026-45038Tabby (formerly Terminus) is a highly configurable terminal …7.8
• CVE-2026-45039RustFS is a distributed object storage system built in Rust.…9.8