Copilot CLI binary contains vulnerable version of adm-zip package
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 11.2k
- Forks
- 1.9k
- Avg merge
- 14h 16m
- Merged PRs (30d)
- 6
Description
Describe the bug
My org uses XRay for scanning Docker image we built and I have a problem with building such an image with latest version of Copilot CLI 1.0.79 - it contains adm-zip v0.5.17 which have High severity CVE - CVE-2026-39244, is it possible to fix it somehow? (update adm-zip to v0.6.0)
Why even fresh Coplot CLI binary includes vulnerable package version, when fix was released in the end of June?
You dont have security assets scans at all?
Thanks.
Affected version
1.0.79
Steps to reproduce the behavior
No response
Expected behavior
No response
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the dependency metadata and build inputs that place adm-zip v0.5.17 in the Copilot CLI binary, using the affected 1.0.79 build as the reference. Update the dependency to v0.6.0, rebuild the binary, and verify that an image or package scan no longer reports CVE-2026-39244.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, javascript
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100