CVE-2026-29783: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29783 is an OS command injection vulnerability in GitHub Copilot CLI's shell tool that allows arbitrary code execution through crafted bash parameter expansion patterns. It affects all versions of the @github/copilot npm package at or below 0.0.422, and was disclosed and patched on March 6, 2026. An attacker who can influence commands executed by the agent — via prompt injection through repository files, MCP server responses, or user instructions — can exploit bash parameter transformation operators to bypass the CLI's safety assessment that classifies commands as "read-only." The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 7.5 (High) (GitHub Advisory, Github Advisory).

The root cause is improper neutralization of special elements used in OS commands (CWE-78). The CLI's shell safety layer parses and classifies commands as either read-only (auto-approved) or write-capable (requires user approval), but fails to account for several bash parameter expansion features that can embed executable code within otherwise benign-looking arguments. The specific dangerous patterns are: ${var@P} (prompt expansion that evaluates embedded command substitutions), ${var=value} / ${var:=value} (assignment side-effects chainable with @P), ${!var} (indirect expansion for dynamic command construction), and nested $(cmd) or <(cmd) inside ${...} expansions. Because the safety assessment sees only the outer command (e.g., echo) and classifies it as read-only, the hidden payload executes without user confirmation — even in permission modes that normally require approval for write operations (GitHub Advisory).

Successful exploitation results in arbitrary code execution on the victim's workstation with the full privileges of the user running GitHub Copilot CLI. An attacker can achieve data exfiltration (stealing source code, credentials, SSH keys, or other sensitive files), unauthorized file modification or deletion, installation of malware or backdoors for persistent access, and potential lateral movement to connected systems or cloud environments. The attack surface is particularly broad because malicious payloads can be embedded in public repository content (README files, code comments, issue bodies), making detection difficult and enabling supply-chain-style attacks against developers (GitHub Advisory, Github Advisory).

A concrete proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating the vulnerability with a runnable bash payload (echo ${a="$"}${b="$a(touch /tmp/pwned)"}${b@P}) that executes arbitrary commands while appearing to be a harmless echo invocation (GitHub Advisory). As of the time of reporting, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.065–0.077%, placing it in the lower percentiles for near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Identify a target: Locate a developer who uses GitHub Copilot CLI version ≤ 0.0.422 and interacts with repositories, MCP servers, or agent-driven workflows.
2. Choose an injection vector: Embed a malicious payload in content the Copilot CLI agent will process — for example, a README.md file, code comment, issue body, or a compromised/malicious MCP server response in a repository the target developer clones or opens.
3. Craft the payload: Construct a bash command that appears read-only but executes arbitrary code via chained parameter expansion. Example PoC from the advisory:

   echo ${a="$"}${b="$a(touch /tmp/pwned)"}${b@P}

   • ${a="$"} assigns the literal $ to variable a.
   • ${b="$a(touch /tmp/pwned)"} expands $a to $, building the string $(touch /tmp/pwned) and assigning it to b.
   • ${b@P} applies prompt expansion to b, causing bash to evaluate the embedded $(touch /tmp/pwned) command substitution.
4. Trigger agent execution: When the Copilot CLI agent processes the injected content and suggests or executes the crafted shell command, the safety assessment classifies echo as read-only and auto-approves execution without user confirmation.
5. Achieve arbitrary code execution: The hidden command (e.g., touch /tmp/pwned, or a more destructive payload such as a reverse shell or data exfiltration script) executes on the victim's workstation with the user's privileges — even in permission modes that normally require approval for write operations (GitHub Advisory).

• File System: Unexpected new files created in /tmp/ or other writable directories (e.g., /tmp/pwned); new or modified cron jobs, shell startup files (.bashrc, .zshrc, .profile), or SSH authorized_keys files; presence of unknown scripts or binaries in user home or temp directories.
• Process: Unusual child processes spawned by the Copilot CLI process (e.g., bash, sh, curl, wget, python, nc) performing network connections or file operations; unexpected touch, cp, rm, or data-staging commands executed in the context of a Copilot CLI session.
• Network: Outbound connections from the developer workstation to unknown or unexpected IP addresses or domains shortly after a Copilot CLI session involving repository content or MCP server interaction; DNS lookups for attacker-controlled infrastructure.
• Logs: Shell history entries (.bash_history, .zsh_history) containing obfuscated parameter expansion patterns such as ${var@P}, ${var:=value}, or nested $(cmd) inside ${...}; audit logs showing file creation or modification events triggered by the Copilot CLI process (GitHub Advisory).

The primary remediation is to upgrade GitHub Copilot CLI (@github/copilot npm package) to version 0.0.423 or later, released March 6, 2026 (GitHub Release). The fix implements three defense layers: parse-time detection that downgrades commands with dangerous expansion patterns (@P, =, :=, !, nested substitutions) from read-only to write-capable; unconditional blocking of such commands at the tool execution layer regardless of permission mode (including --yolo/autopilot); and system prompt hardening instructing the LLM to refuse executing commands with these patterns. As interim workarounds, users should avoid working in untrusted repositories or with untrusted MCP servers, and carefully review any agent-suggested shell commands containing complex parameter expansion before approving execution (GitHub Advisory).

The advisory was published by GitHub maintainer andyfeller on March 6, 2026, and received community attention on social platforms including Bluesky and Mastodon/infosec.exchange shortly after disclosure. Red Hat also tracked the vulnerability under their security advisory system. The vulnerability attracted broader interest given its relevance to AI-assisted development tools and the emerging threat of prompt injection attacks against LLM-powered CLI agents (GitHub Advisory, Red Hat CVE).