STUPID-2026-0101

GitHub Copilot CLI ran arbitrary attacker commands via a nested bare git repository abusing core.fsmonitor (CVE-2026-45033)

8.5high
May 6, 2026VerifiedReproducible

  1. Instruction given

    N/A — no user instruction was needed. The flaw triggered during routine background git operations (e.g. `git status`, `git diff`) that Copilot CLI runs on its own while working in a project directory.

  2. Expected behavior

    Copilot CLI's routine git operations should never execute a command sourced from a repository the user has not explicitly trusted, regardless of where in the directory tree that repository's configuration comes from.

  3. Actual behavior

    Git's automatic bare-repository discovery let a bare `.git` repository nested inside a project subdirectory (e.g. `vendor/malicious.git/`) supply its own `core.fsmonitor` config value. Because `core.fsmonitor` names a program git runs automatically whenever a routine operation refreshes the index, simply having Copilot CLI run `git status` or `git diff` inside a directory tree containing the planted bare repo was enough to execute an attacker-chosen command with the developer's own privileges — no prompt, click, or explicit approval required.

  4. Damage

    Rated CVSS 8.5 (High; AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H). An attacker who could get a nested bare repository into a project — via a pull request, a compromised dependency, or any tree Copilot CLI was pointed at — could achieve arbitrary code execution on the developer's machine, with full confidentiality, integrity, and availability impact. Affected npm package @github/copilot versions up to and including 1.0.42; fixed in 1.0.43 by setting `safe.bareRepository=explicit` to stop automatic bare-repository discovery.

GitHub published a security advisory (GHSA-9ccr-r5hg-74gf, CVE-2026-45033, credited to researcher syvb) disclosing that GitHub Copilot CLI could be made to execute arbitrary commands through a nested bare git repository. Git automatically discovers bare repositories while walking a directory tree and applies their configuration, including `core.fsmonitor` — a setting whose value is a program git runs on its own whenever an operation like `git status` or `git diff` refreshes the index. An attacker who planted a bare repository inside a project subdirectory (for example `vendor/malicious.git/`) could set `core.fsmonitor` to an arbitrary command and have it run the moment Copilot CLI performed one of the routine git operations it issues in the background — no user interaction of any kind. The advisory rates the flaw CVSS 8.5 (High), affecting `@github/copilot` versions up to 1.0.42. GitHub fixed it in 1.0.43 by setting `safe.bareRepository=explicit`, which disables git's automatic bare-repository discovery. The underlying `core.fsmonitor` execution-during-background-git-ops pattern was later reported to affect several other AI coding agents as well, but this advisory is GitHub's own, specific to Copilot CLI.

Classification

Agent
GitHub Copilot
Failure mode
Security Vulnerability
Root cause
Tool Misuse
Domain
Security
Source
Security Research

Related incidents

10.0
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
10.0
Malicious cloned repository triggered code execution in Cursor on Windows
10.0
AI vibe-coded Next.js app pinned vulnerable dependency — cryptominer compromised production server
10.0
Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.