GitHub Copilot Workspace Agent Vulnerable to Command Injection via Malicious Markdown
Overview
A high-severity command injection vulnerability was discovered in the beta version of GitHub Copilot Workspace. This feature provides an AI-native development environment where a Copilot agent can analyze a repository, create a plan, and execute commands to accomplish a development task. The vulnerability stemmed from the agent's processing of repository files, specifically Markdown (`.md`) files. An attacker could craft a malicious repository containing a README.md file with a specially formatted code block, such as a PlantUML or Mermaid diagram, that contained embedded shell commands. When a user opened this repository in Copilot Workspace and asked the agent to perform a task (e.g., 'refactor the main function'), the agent would parse the README.md as part of its context gathering. The parser for the diagramming tool would incorrectly interpret and execute the embedded commands within the agent's sandboxed environment. This allowed the attacker to execute arbitrary code within the Copilot Workspace session, leading to the exfiltration of sensitive information, most notably the temporary `GITHUB_TOKEN` available as an environment variable. With this token, the attacker could gain write access to the victim's repositories, further propagating the attack.
Affected Systems
Testing Guide
1. Check the version of your GitHub Copilot extension. If it corresponds to a Workspace version earlier than 0.8.0, you may be vulnerable. 2. **(Safe Test)** Create a private repository with a README.md file containing a Mermaid diagram with a benign command, like: ````markdown ```mermaid graph TD; A-->B; !!{command:"echo 'test' > /tmp/pwned"}!! ``` ```` 3. Open the repository in Copilot Workspace and ask the agent a general question about the code. 4. Check if the file `/tmp/pwned` was created in the workspace's container. If so, the system is vulnerable.
Mitigation Steps
1. **Update Copilot Extensions:** Ensure your GitHub Copilot extensions in your IDE (e.g., VS Code) are updated to the latest version, which includes the patched Workspace feature. 2. **Be Cautious with Untrusted Repositories:** Avoid using GitHub Copilot Workspace on unfamiliar or untrusted repositories until you have manually audited their content for suspicious files. 3. **Restrict Agent Permissions:** When launching a workspace, review and limit the permissions granted to the agent. Do not provide it with access to sensitive secrets or broad repository write access unless absolutely necessary for the task. 4. **Monitor Agent Actions:** Keep the agent's terminal output visible and monitor the commands it executes to ensure it is not performing any unexpected actions.
Patch Details
The vulnerability was addressed by GitHub in the Copilot Workspace 0.8.0 beta release by sanitizing input from rendered Markdown files.