npm package report

Is @github/copilot safe?

2 known vulnerabilities, worst severity HIGH.

cvss
8.5

how bad it is if exploited, out of 10

epss
0.40%

chance of exploitation in the next 30 days

xyz score
4.4

CyberXYZ composite, out of 10

fig. 01 — GHSA-9ccr-r5hg-74gf, the advisory selected below

// advisories

GHSA-9ccr-r5hg-74gf

HIGHCVE-2026-45033

A security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory traversal, an attacker can set core.fsmonitor or other executable config keys to run arbitrary commands without

Affected
<= 1.0.42, >=0, <1.0.43
Fixed in
1.0.43
Weakness
CWE-696
Published
2026-05-11
Source
github

GHSANVDMITREreference

// dependencies

0 direct

Sign in for dependency paths and remediation

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 02:31 UTC. The most recent advisory here was published 2026-05-11. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.
Is @github/copilot safe? npm package security report | CyberXYZ