GitHub Copilot CLI before version 1.0.43 contains a security vulnerability (CVE-2026-45033) where a malicious bare git repository nested within a project directory can cause arbitrary code execution. This is due to git's automatic bare repository discovery during directory traversal, which allows an attacker to set executable configuration keys like core.fsmonitor and others (e.g., core.hookspath, diff.external, merge.tool). These keys specify shell commands that git executes during normal operations such as status, diff, or rev-parse. Exploiting this behavior enables running arbitrary commands without user awareness or approval. The vulnerability is addressed in Copilot CLI version 1.0.43.

An attacker who can place a malicious bare git repository inside a project directory can execute arbitrary code with the privileges of the user running GitHub Copilot CLI. This can lead to unauthorized command execution without user interaction or approval, potentially compromising the affected system. The CVSS 4.0 score is 8.5 (high severity), reflecting the significant risk of local privilege misuse and code execution.

Upgrade GitHub Copilot CLI to version 1.0.43 or later, where this vulnerability is fixed. Since the vulnerability is resolved in this version, no additional mitigation steps are required.