GitHub Copilot 2026 flaws: CLI shell-expansion RCE, JetBrains plugin command injection, VS Code privilege escalation and RoguePilot

What happened

GitHub and Microsoft fixed three Copilot-related CVEs in 2026. Researchers also published two prompt-injection chains that have no CVE.

• CVE-2026-21516, Copilot for JetBrains (published 10 February 2026). A command injection flaw that “allows an unauthorized attacker to execute code over a network”. User interaction is required. Microsoft rates it CWE-77 (CVE record).
• CVE-2026-29783, Copilot CLI (published 6 March 2026). The CLI’s safety check could label a shell command “read-only” even when it used bash parameter expansion to run hidden commands: prompt expansion (@P), assignment forms (=, :=), indirect expansion (!), and $(...) or <(...) nested inside ${...} defaults. GitHub says the trigger can be prompt injection in repository content, a malicious MCP server response, or crafted instructions, and that it worked even in modes that ask before writes. The fix makes these patterns require approval, blocks them at the tool layer even under --yolo and autopilot, and tells the model to refuse them (GitHub advisory).
• CVE-2026-70335, Copilot and VS Code (published 11 August 2026). An OS command injection that lets an attacker raise privileges locally, with user interaction. The CVE record lists only VS Code as the affected product, fixed in 1.132.1 (CVE record).
• RoguePilot, Copilot in Codespaces (no CVE, published 16 February 2026). Orca hid instructions in an HTML comment in a GitHub issue. Opening a Codespace from the issue fed it to Copilot, which checked out a pull request with a symlink to /workspaces/.codespaces/shared/user-secrets-envs.json. Copilot’s file reader followed the link and read the GITHUB_TOKEN. Copilot then wrote a JSON file whose $schema URL carried the token, and VS Code fetched it because json.schemaDownload.enable is on by default in Codespaces. Orca says GitHub responded promptly and worked on remediation, but gives no fix date (Orca Security).
• Cryptographic context injection, Copilot CLI autopilot (no CVE, published 6 October 2026). Adversa hid encrypted instructions in a web page. When a user in autopilot asked Copilot CLI to fetch it, the agent decrypted the text in its own shell, read local secret files and sent them out, in about 28 seconds. GitHub validated the report but declined it as a vulnerability, because the user “explicitly asked Copilot CLI to fetch attacker-controlled content while giving copilot full permissions to act autonomously” (Adversa).

Am I affected?

Check each Copilot surface you use:

# Copilot CLI (fixed in 0.0.423)
copilot --version
npm ls -g @github/copilot

# VS Code (fixed in 1.132.1)
code --version

# Copilot extensions installed in VS Code
code --list-extensions --show-versions | grep -i copilot

For JetBrains IDEs, open Settings > Plugins > Installed and read the GitHub Copilot version, or list the plugin folder:

# macOS; on Linux look under ~/.local/share/JetBrains, on Windows under %APPDATA%\JetBrains
ls ~/Library/Application\ Support/JetBrains/*/plugins/ | grep -i copilot

The Copilot CLI is also affected wherever it runs unattended. Search your CI for it:

grep -rnE '@github/copilot|copilot (-p|--prompt)|--yolo|--allow-all' .github/workflows/ scripts/ 2>/dev/null

What to do now

1. Update Copilot CLI to 0.0.423 or later: npm install -g @github/copilot@latest. Update any pinned version in CI images and workflows (GitHub advisory).
2. Update the Copilot plugin for JetBrains to 1.5.63 or later in every JetBrains IDE, from the Plugins settings page (CVE record).
3. Update VS Code to 1.132.1 or later. If you manage VS Code centrally, push the update rather than waiting for auto-update (CVE record).
4. Read Copilot CLI shell commands that use ${...} before approving them. GitHub’s advisory singles out complex parameter expansion as the pattern to check (GitHub advisory).
5. Keep autopilot away from untrusted input. GitHub’s position on the Adversa chain is that fetching attacker content in autopilot is the user’s choice, so no patch is coming for it. Do not ask Copilot CLI in autopilot to fetch pages, read issues or use MCP servers you do not control, and do not run it in a directory that holds production secrets (Adversa).
6. Be careful opening Codespaces from issues and pull requests by outsiders. RoguePilot started from an issue an attacker wrote and a pull request they created. The token it stole is the one in user-secrets-envs.json (Orca Security).

Sources

• GitHub advisory GHSA-g8r9-g2v8-jv6f: Copilot CLI, CVE-2026-29783
• CVE record: CVE-2026-21516
• CVE record: CVE-2026-70335
• Orca Security: RoguePilot
• Adversa: cryptographic context injection against GitHub Copilot CLI