Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/%40github/copilot@0.0.423
purl pkg:npm/%40github/copilot@0.0.423
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-ydpt-fr5c-r3e6 GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution A security vulnerability has been identified in GitHub Copilot CLI's shell tool that could allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent (e.g., via prompt injection through repository files, MCP server responses, or user instructions) can exploit bash parameter transformation operators to execute hidden commands, bypassing the safety assessment that classifies commands as "read-only." CVE-2026-29783
GHSA-g8r9-g2v8-jv6f

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-05T22:03:11.236995+00:00 GHSA Importer Fixing VCID-ydpt-fr5c-r3e6 https://github.com/advisories/GHSA-g8r9-g2v8-jv6f 38.6.0
2026-06-04T16:58:37.711849+00:00 GithubOSV Importer Fixing VCID-ydpt-fr5c-r3e6 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-g8r9-g2v8-jv6f/GHSA-g8r9-g2v8-jv6f.json 38.6.0
2026-06-02T04:51:24.538480+00:00 GitLab Importer Fixing VCID-ydpt-fr5c-r3e6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@github/copilot/CVE-2026-29783.yml 38.6.0