## Summary A security vulnerability has been identified in GitHub Copilot CLI's shell tool that could allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent (e.g., via prompt injection through repository files, MCP server responses, or user instructions) can exploit bash parameter transformation operators to execute hidden commands, bypassing the safety assessment that classifies commands as "read-only." ## Details The vulnerability stems from how the CLI's shell safety assessment evaluates commands before execution. The safety layer parses and classifies shell commands as either read-only (safe) or write-capable (requires user approval). However, several bash parameter expansion features can embed executable code within arguments to otherwise read-only commands, causing them to appear safe while actually performing arbitrary operations. The specific dangerous patterns are: 1. **`${var@P}` , Prompt expansion:** The `@P` parameter transformation operator evaluates its value as a prompt string, which interprets embedded command substitutions. This allows hidden command execution inside what appears to be a simple variable reference. 2. **`${var=value}` / `${var:=value}` , Assignment side-effects:** These forms assign values to variables as a side-effect of expansion. When chained with `@P`, an attacker can progressively build up a command substitution string across multiple expansions. 3. **`${!var}` , Indirect expansion:** Dereferences an arbitrary variable name, which can be combined with other patterns to construct and execute commands dynamically. 4. **Nested `$(cmd)` or `<(cmd)` inside `${...}` expansions:** Command substitution or process substitution embedded within parameter expansion default values (e.g., `${HOME:-$(whoami)}`) executes the nested command. ### Proof of Concept The following command appears to run a harmless `echo`, but actually executes `touch /tmp/pwned` through chained parameter expansion: ```bash echo ${a="quot;}${b="$a(touch /tmp/pwned)"}${b@P} ``` **How it works:** - `${a="quot;}` assigns the literal `