CVE-2026-45033 is a vulnerability in GitHub Copilot CLI before version 1.0.43 where a malicious bare git repository nested inside a project directory can cause arbitrary code execution. The root cause is git's automatic discovery of bare repositories during directory traversal, which allows an attacker to set executable config keys like core.fsmonitor, core.hookspath, diff.external, and merge.tool to arbitrary shell commands. These commands are executed by git during routine operations such as status, diff, or rev-parse without user awareness or approval. The vulnerability is classified under CWE-696 (Incorrect Behavior Order).

An attacker who can place a malicious bare git repository inside a project directory can execute arbitrary code on the victim's system when the GitHub Copilot CLI performs git operations. This can lead to full compromise of the environment running the vulnerable CLI version. The CVSS 4.0 score is 8.5 (high severity), reflecting the local attack vector with low complexity but high impact on confidentiality, integrity, and availability.

Upgrade GitHub Copilot CLI to version 1.0.43 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in 1.0.43, applying this official fix is the recommended remediation. No other mitigation or temporary workaround is provided in the available data.