# GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor

A nested bare git repo with core.fsmonitor set lets GitHub Copilot CLI execute arbitrary commands when it runs routine git operations.

- Payout: Research
- Severity: high
- Program: GitHub
- Found by: syvb
- Disclosed: 2026-05-11
- CVE: CVE-2026-45033
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-9ccr-r5hg-74gf
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-9ccr-r5hg-74gf
- Tags: area:os domain:desktop impact:data-leak impact:rce kind:research platform:ghsa sev:high tech:nodejs technique:source-review vuln:command-injection vuln:rce

**Target:** CLI coding agent performing git operations in project directories
**Root cause:** Git auto-discovers bare repositories during directory traversal and applies their config, including executable keys like core.fsmonitor; Copilot CLI did not disable this discovery before running git commands.
**Steps:**
1. Create a bare git repo nested in a project dir, e.g. `vendor/malicious.git/`
2. Set `core.fsmonitor` (or `core.hookspath`, `diff.external`, `merge.tool`) in that bare repo's config to a malicious shell command
3. Trigger Copilot CLI to run a git operation (`git status`, `git diff`, `rev-parse`) or a tool like grep/glob that traverses into the directory
4. Git auto-discovers the bare repo, reads its config, and executes the attacker's command
**How found:** Recognized that git auto-discovers bare repositories during directory traversal and that 15+ config keys (core.fsmonitor, core.hookspath, diff.external, merge.tool) specify external commands, then reasoned that an agent running routine git commands would trigger them.
**Exploitation:** Attacker plants a bare repo via a pull request, malicious dependency, or cloned repo; when the agent runs git in or near that directory, the configured command executes on the user's workstation, enabling data exfiltration, credential theft, or file modification.
**Insight:** Agentic tools that shell out to git inherit git's implicit trust of discovered repos; test nested bare repos and executable config keys (core.fsmonitor, core.hookspath, diff.external) as a code-exec vector, and check whether the tool pins safe.bareRepository=explicit.