What changed
GitHub published advisory GHSA-qmmc-575c-v2h8 on 20 October 2026. It maps to CVE-2026-109443. The summary states that JoySafeter through 1.0.0 allows signed in users to run remote code on the server.
The flaw sits in Copilot standard mode. A user can drive an execute tool that is not sandboxed. The tool calls the host shell with shell=True. The advisory says attackers may self register, pick standard mode in the WebSocket chat start extension, and then run OS commands. That can expose other tenants data and server secrets.
References point to JoySafeter source files for the command helper and copilot service in the jd-opensource repo. CVSS 3.1 score is 8.8 high with network access and low privileges required.
Why it matters
Agent copilots that mix LLM tools with shell access are a growing attack surface. A low privilege account that can spawn a shell breaks tenant isolation for multi tenant SaaS deployments. Security teams must treat copilot modes as code execution tiers, not chat skins.
The issue also shows why self serve signup plus powerful tools is a risky default. A bot farm can probe modes without a sales call.
Who is affected
Teams running self hosted JoySafeter for internal copilots should assume versions through 1.0.0 are vulnerable until they verify a fix. Managed service providers offering JoySafeter based assistants must audit tenant signup flows and mode defaults. Red teams evaluating AI agent platforms should add copilot tool policies to standard test cases.
Legal and privacy staff should note cross tenant data reads if shells share one host volume.
What to do next
Inventory any JoySafeter deploy at or below 1.0.0. Disable Copilot standard mode or block self registration until you apply a vendor patch or your own hardening wrapper. Review command executor paths cited in the advisory and enforce sandboxed runners without shell=True for agent tools.
Rotate secrets that lived on the same host as a vulnerable instance. Review access logs around 20 October 2026 for odd execute calls tied to copilot sessions. Tell support staff what mode names to watch in tickets.
What to watch
Watch the jd-opensource JoySafeter repo for a tagged fix and release notes after GHSA publication. Watch NVD for updated affected version ranges. Watch your SIEM for copilot session tokens invoking execute tools after hours.
Watch whether your org adds a second approval step before any agent tool can touch the shell, even after patching.
Compare JoySafeter copilot modes to other agent frameworks you already run. Many products expose a read only mode and a tools mode with separate RBAC. Map standard mode to your highest risk tier in the internal control matrix even if the UI label sounds benign.
If you host multiple tenants on one VM, assume secrets in env files were in scope until you prove isolation. The advisory text mentions server secrets, not only user uploaded files. Incident response playbooks should include a copilot session id field starting with the October 2026 disclosure date.
Product managers should rename modes in the UI if the word standard hides shell access. Training videos for internal copilots need a slide on which modes run code on the host. Bug bounty scope should list JoySafeter if it faces the public internet.
CWE-653 in the advisory points to weak isolation between tenants. Use that label when you file tickets with your GRC tool so trends roll up with other agent platform bugs from 2026.
If you cannot patch quickly, network restrict admin URLs and disable public signup until maintainers ship a fix above version 1.0.0.
Share the GHSA link with your appsec channel so copilot features get the same review bar as admin APIs. Note the October 2026 publish date on internal status pages.
Treat any copilot execute tool as shell access in threat models until vendor docs prove otherwise.
Photo: cottonbro studio / Pexels
Sources
- Primary — GitHub, GHSA-qmmc-575c-v2h8 advisory (20 October 2026). CVE id, copilot mode attack path, and CVSS.
- Primary — JD Open Source, command_executor.py reference line (2026). Code path cited by the advisory.
- Secondary — NVD, CVE-2026-109443 detail page (20 October 2026). Federal listing mirrored from the GHSA record.
Related in Cyber Security
Continue reading