CVE-2026-29783

Shell expansions can bypass Copilot CLI’s read-only command check

GitHub · Copilot CLI Bash shell tool

First documented disclosure · Review checkpoint

Summary

A command approved as read-only can cause the shell to execute additional operations.

Severity and exploitation evidence

High · 7.5/10 · CVSS 4.0. Severity source.

Exploitation not established: GitHub documents the vulnerable patterns and impact. Malicious use is not established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The safety parser did not account for executable substitutions nested in certain Bash parameter expansions.

Conditions required

An attacker can influence shell text through content the agent processes, and the agent uses the affected shell tool.

Potential impact

Hidden operations run with the user’s workstation permissions and can modify files or disclose data.

Affected versions and configurations

GitHub identifies versions through 0.0.422.

Fix and mitigation status

0.0.423 fixes the reported expansion patterns.

Practical next steps

Update the CLI and review shell activity associated with untrusted repositories or tool responses.

Operating lesson

Test what a shell expansion executes before classifying a command as read-only.

Evidence and limits

GitHub published the advisory, release and CVE on March 6. The fix applies to these specific expansion patterns.

Sources