CVE-2026-45033: Copilot CLI could run attacker commands from a planted bare git repo

GitHub has disclosed and fixed a flaw in Copilot CLI that could turn a file planted inside a project into arbitrary command execution on a developer's machine, with no action required from the user. According to a write-up on dev.to, GitHub's advisory (GHSA-9ccr-r5hg-74gf, CVE-2026-45033) credits the find to researcher syvb and lists every release of @github/copilot up to and including 1.0.42 as affected. Version 1.0.43 ships the fix.

How the attack works

The bug does not involve the model at all. It leans on standard git behavior. As dev.to describes it, git automatically discovers bare repositories while walking a directory tree and applies the configuration stored in them. One such setting, core.fsmonitor, names a program that git launches on its own whenever a routine operation such as git status or git diff refreshes the index.

Copilot CLI runs those kinds of git operations in the background by itself while working in a directory. Put the two together and a planted bare repository becomes a trigger. Someone who could slip a directory such as vendor/malicious.git/ into a project — through a pull request, a compromised dependency, or any tree the agent happened to be pointed at — could set core.fsmonitor to an arbitrary command. The next time Copilot CLI performed one of its routine git tasks, that command would run. No prompt, click or approval dialog stands in the way.

Severity and the fix

The advisory scores the vulnerability 8.5 on the CVSS scale (High), with a vector indicating a local attack path, low complexity, low required privileges, no user interaction, and high impact on confidentiality, integrity and availability. The fix, delivered in 1.0.43, sets safe.bareRepository=explicit, which switches off git's automatic bare-repository discovery so configuration found in stray bare repositories is no longer picked up.

Dev.to is careful about what the advisory does not say: it does not explain how the vulnerable behavior was introduced, whether internal review or the external report surfaced it first, or how many installations were running an affected release before 1.0.43 landed. It also does not claim any exploitation in the wild — this is a disclosed and patched flaw, not a confirmed incident with victims. Anyone still on 1.0.42 or earlier should update.

A pattern beyond Copilot

The dev.to write-up adds one caveat about scope: the same core.fsmonitor-via-background-git-operations pattern was later reported to affect other AI coding agents as well. The advisory and the write-up cover Copilot CLI specifically, so the situation for other tools is a separate story.

Why it matters

Dev.to places this among several security issues involving Copilot, but notes it is mechanically different from the rest. Earlier problems targeted what the model reads or generates: hidden-Unicode prompt injection, autocomplete surfacing leaked credentials, and the CamoLeak exfiltration channel rated CVSS 9.6. This flaw instead targets the agent's background tooling — the git commands it issues unprompted while doing its job.

That distinction matters for how the industry thinks about agent safety. No model reasoning is involved here, so a smarter or more cautious model does not close the gap. The gap exists between an agentic CLI needing to run git operations to stay useful, and git's willingness to execute configuration it finds lying in the directory tree. Closing it required narrowing what the tool trusts by default — exactly the kind of fix GitHub shipped. It is a useful template for every other coding agent that shells out to git in the background.