CVE-2026-45033

HIGH

GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-45033 has a selected CVSS score of 8.5 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory traversal, an attacker can set core.fsmonitor or other executable config keys to run arbitrary commands without user awareness or approval. The vulnerability arises because git's core.fsmonitor config key (and 15+ similar keys such as core.hookspath, diff.external, merge.tool, etc.) can specify arbitrary shell commands that git will execute as part of normal operations like status, diff, or rev-parse. This vulnerability is fixed in 1.0.43.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 13, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

copilot-cli

Browse github / copilot-cli
CVE List< 1.0.43affected

@github/copilot

Browse npm / @github/copilot
GitHub AdvisoryBefore 1.0.43 · Fixed in 1.0.43affected

Proofs of concept

1

Repository PoCs

GitHubgrassplatypus/cve-2026-45033-classRepository PoCby grassplatypus0Exploit22 files

33.8 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

PoC exploit for CVE-2026-45033, adapted for Claude Code. It plants a malicious bare git repository with a core.fsmonitor config to achieve arbitrary code execution inside the agent's sandbox when git status runs. The README describes two bypasses of Claude Code's bash permission guard and provides scripts to build and run the exploit in a Docker container.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README and a container run script for a proof-of-concept demonstrating a git bare-repo / core.fsmonitor vulnerability against Claude Code. The PoC describes an inert payload that payload withheld and explicitly states it performs no network, file reads, or destructive actions. No concealed executable behavior, credential theft, persistence, or unrelated payload is present in the supplied text.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagesbashmarkdown
Target softwareclaude codegit
Attack typesarbitrary code executioncommand injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is explicitly labeled as a 'Proof-of-concept' and describes code that plants a malicious git repository to achieve code execution when the agent runs git commands. The README details the exploitation mechanism and provides instructions to run the exploit, which is the primary purpose of the artifact.

README.md:1-10

Requirements

  • Requires a Claude Code agent session with authentication to run the live test.README.md:51-55
  • Requires Docker to build and run the containerized test environment.container/run.sh:1-104

Observed behavior

  • Creates a malicious bare git repository with core.fsmonitor set to an arbitrary command.README.md:3-6
  • Bypasses Claude Code's bash permission guard using symlink path-laundering or command-name gap techniques.README.md:20-30
  • Executes a payload (payload withheld) when the agent runs git status.README.md:8-10
  • Provides a Docker-based test bench to run the exploit against vulnerable and patched Claude Code versions.container/run.sh:1-104
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Behavior
Payload withheldThe README describes the payload as inert, writing only a timestamp marker file, with no network, file reads, or destructive action.README.md:9-10README.md:65-66
Disclosure
Payload withheldThe README explicitly states the PoC is defensive research and instructs users to test only against software and accounts they own.README.md:67-68
Review boundaries

What the analysis did not establish

  • Only 2 of 22 text files were included in the evidence; the actual exploit scripts (e.g., build.sh, verify.sh, malicious-repo contents) are not provided, so the analysis is based solely on the README and run.sh descriptions.
  • The evidence does not include the source code of the bypass or payload, only high-level descriptions of the techniques.
  • Only 2 of 22 text files in the repository were included in the evidence packet; 20 text files were omitted and not reviewed.
  • The evidence packet states binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED, but no binary files were identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

container

grassplatypus/cve-2026-45033-classCreated Vuln labCVE-2026-45033Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based test bench that installs two adjacent versions of Claude Code (2.1.162 and 2.1.163) side by side for A/B testing a git bare-repo / core.fsmonitor guard bypass vulnerability. The container includes a malicious repository PoC and scripts to build, run, and reset the environment.

container/Dockerfile:1-65README.md:1-68

Lab assessment

Vulnerability lab

The README explicitly states it is a proof-of-concept for a vulnerability class (CVE-2026-45033) reproduced against Claude Code, and the Dockerfile installs both a vulnerable and a patched version for comparison. Scripts automate building the image, running the agent, and resetting the test state.

README.md:1-10container/Dockerfile:1-5
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds the test bench image

Defines a Node.js 22 Bookworm Slim image that installs two pinned versions of @anthropic-ai/claude-code (2.1.162 and 2.1.163) under /opt, creates wrapper scripts (claude162, claude163), sets up an unprivileged 'tester' user, copies the PoC tree, and disables auto-updates and telemetry.

container/Dockerfile:1-65

build.sh

builds the Docker image

Assembles a temporary build context containing the Dockerfile and the PoC tree (excluding generated output), then runs 'docker build' to create the image tagged cc-cve-bench:latest.

container/build.sh:1-29

run.sh

orchestrates container execution

Provides a CLI to start the test bench container in various modes: login (authenticate Claude Code), verify (run the no-agent environment check), shell (interactive session with a fresh checkout), or raw (pass arbitrary commands). Uses a named Docker volume for persistent authentication and runs containers with --rm.

container/run.sh:1-104

reset.sh

resets the test state inside the container

Prepares a fresh checkout of the malicious repository (acme-web-platform) and optionally writes a Claude Code permissions allowlist to suppress prompts on the vulnerable version. Also clears the marker file /tmp/.bench-marker.

container/reset.sh:1-56
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-45033

Supported by supplied evidence

The README explicitly associates the PoC with CVE-2026-45033, describing it as a reproduction of the vulnerability class against Claude Code. The environment is designed to demonstrate the bypass and verify the fix.

README.md:3-6
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed and the daemon running to build the image and run containers.container/build.sh:20container/run.sh:40
  • An Anthropic API key (or interactive login) is required to use Claude Code inside the container.container/run.sh:47container/run.sh:55-63
  • The malicious repository must be built (via malicious-repo/build.sh) before the verify or shell modes can exercise the vulnerability.container/reset.sh:30container/run.sh:72

Evidence-described exercise path

  1. Build the Docker image: cd container && ./build.shcontainer/build.sh:1-29
  2. Authenticate Claude Code once: ./run.sh logincontainer/run.sh:50-63
  3. Start an interactive shell with a fresh malicious checkout: ./run.shcontainer/run.sh:78-103
  4. Inside the container, run the Claude Code agent (claude or claude162 for vulnerable, claude163 for patched) and follow the prompt to trigger the vulnerability.container/run.sh:88-99
  5. Observe the marker file /tmp/.bench-marker to confirm code execution.container/run.sh:95
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the contained lab target. The payload writes an inert timestamp to /tmp/.bench-marker inside the container. The container runs with --rm, uses an unprivileged user, and does not mount the Docker socket or host filesystem. No hidden, destructive, or exfiltration behavior is observed.

README.md:60-63container/Dockerfile:46-48container/run.sh:40-45
Review boundaries

What the analysis did not establish

  • The malicious repository (malicious-repo/) and its build/verify scripts are not included in the evidence packet, so the exact mechanism of the git bare-repo injection and the payload cannot be fully inspected.
  • The Dockerfile uses npm install without --ignore-scripts, which is noted as intentional for fetching platform binaries, but the specific behavior of those lifecycle scripts is not visible in the supplied evidence.
  • The run.sh script uses --network host in login mode, which could expose host network interfaces, but this is limited to the authentication step and is a common pattern for OAuth flows.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

3