@github/copilot

GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal.

Latest 1.0.98

NPM

82%

Total Score

healthy

Rapid releases and active GitHub-backed maintenance outweigh high-confidence workflow template-injection findings.

Are you affected? Scan for Free

Health Score Breakdown

Version stability

Version 1.0.98 is a stable, non-prerelease release, although 80% of recent releases were prereleases. The current stable version is reassuring, with the prerelease-heavy history a minor maturity concern.

Workflow audit

All 11 workflows were analyzed with no untrusted checkout or script-injection findings, and all action references are pinned. However, two high-confidence template-injection findings in winget.yml and top-level write permissions in 7 workflows are meaningful workflow hygiene risks.

Vulnerabilities

Title	Versions	Severity
CVE-2026-45033 @github/copilot is vulnerable to Incorrect Behavior Order in versions 0.0.0 - 1.0.42.	0.0.0 - 1.0.42	High
CVE-2026-29783 @github/copilot is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.0.0 - 0.0.422.	0.0.0 - 0.0.422	High