GitHub Security Advisory: GHSA-g8r9-g2v8-jv6f
Package: @github/copilot (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 0.0.422
Patched in: 0.0.423

Summary: GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution

Details:
## Summary

A security vulnerability has been identified in GitHub Copilot CLI's shell tool that could allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent (e.g., via prompt injection through repository files, MCP server responses, or user instructions) can exploit bash parameter transformation operators to execute hidden commands, bypassing the safety assessment that classifies commands as "read-only."

## Details

The vulnerability stems from how the CLI's shell safety assessment evaluates commands before execution. The safety layer parses and classifies shell commands as either read-only (safe) or write-capable (requires user approval). However, several bash parameter expansion features can embed executable code within arguments to otherwise read-only commands, causing them to appear safe while actually performing arbitrary operations.

The specific dangerous patterns are:

1. **`${var@P}` — Prompt expansion:** The `@P` parameter transformation operator evaluates its value as a prompt string, which interprets embedded command substitutions. This allows hidden command execution inside what appears to be a simple variable reference.

2. **`${var=value}` / `${var:=value}` — Assignment side-effects:** These forms assign values to variables as a side-effect of expansion. When chained with `@P`, an attacker can progressively build up a command substitution string across multiple expansions.

3. **`${!var}` — Indirect expansion:** Dereferences an arbitrary variable name, which can be combined with other patterns to construct and execute commands dynamically.

4. **Nested `$(cmd)` or `<(cmd)` inside `${...}` expansions:** Command substitution or process substitution embedded within parameter expansion default values (e.g., `${HOME:-$(whoami)}`) executes the nested command.

### Proof of Concept

The following command appears to run a harmless `echo`, but actually executes `touch /tmp/pwned` through chained parameter expansion:

```bash
echo ${a="$"}${b="$a(touch /tmp/pwned)"}${b@P}
```

**How it works:**
- `${a="$"}` assigns the literal `$` character to variable `a`
- `${b="$a(touch /tmp/pwned)"}` expands `$a` to `$`, constructing the string `$(touch /tmp/pwned)` and assigning it to `b`
- `${b@P}` applies prompt expansion to `b`, which evaluates the embedded `$(touch /tmp/pwned)` command substitution

Prior to the fix, the safety assessment would classify `echo` as a read-only command and allow execution without user confirmation — even in modes that normally require approval for write operations.

## Impact

An attacker who can influence command text sent to the shell tool — for example, through:
- Prompt injection via malicious repository content (README files, code comments, issue bodies)
- Compromised or malicious MCP server responses
- Crafted user instructions containing obfuscated commands

— could achieve arbitrary code execution on the user's worksta