GitHub's Copilot CLI, released just two days prior, harbors critical vulnerabilities allowing attackers to bypass its human-in-the-loop approval system and execute malware on victims' computers. The flaws center on command validation failures, specifically a hard-coded 'read-only' command list in the source code. This list includes the 'env' command, which incorrectly parses arguments like 'curl -s' and 'sh', preventing the system from detecting malicious URLs.

Consequently, commands triggering remote code execution (RCE) are automatically approved without user consent. Remote code execution occurs when users interact with compromised repositories, such as README files containing malicious instructions. Read-only command list bypass enables malware downloads and execution without any approval prompts, as demonstrated in the attack chain where GitHub Copilot executes the malicious command directly. GitHub acknowledged the report but classified the issue as a 'known issue' not presenting a 'significant security risk,' closing the disclosure without immediate fixes.