Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)

Summary

Security researcher Embrace The Red disclosed CVE-2026-103572, an Important-severity Remote Code Execution vulnerability affecting GitHub Copilot integrated into Visual Studio and SQL Server Management Studio (SSMS). Microsoft shipped a patch as part of Patch Tuesday on October 13, 2026, assigning a CVSS score of 8.8.^[0][1]

The flaw is a file-path validation bypass in the shared Copilot DLL Microsoft.VisualStudio.Copilot.Core.dll. By appending a trailing dot to protected configuration filenames (e.g., `.mcp.json.` or `settings.VisualStudio.json.`), the Copilot agent evades a protected-filename check because Windows normalizes away the trailing period when the write actually occurs, letting the agent modify files it was explicitly restricted from touching and ultimately achieve arbitrary command execution.^[0]

The researcher demonstrated the issue could be triggered by a third party through indirect prompt injection, hijacking Microsoft's MAI-Code-1-Flash model to write malicious settings and launch an attacker-controlled binary. This is vulnerability-research disclosure with proof-of-concept demos; there is no evidence of in-the-wild exploitation.^[0]

Attack chain

1. Initial Access / Injection: A misaligned or hijacked Copilot agent is steered via indirect prompt injection — malicious instructions delivered through file content or data returned from an MCP server — to act on behalf of an attacker.^[0]
2. Path Validation Bypass: The agent writes to a protected configuration file using a trailing-dot variant of the name (e.g., `settings.visualstudio.json.` or `~/.mcp.json.`), which passes the string-comparison protected-filename check but is canonicalized by Windows to the real protected file on write.^[0]
3. Reconnaissance / Discovery: For the MCP exploit path, the attacker uses path-traversal bypasses to read SSMS.isolation.ini, which discloses the InstallationID needed to construct the correct per-installation settings.json path.^[0]
4. Configuration Tampering: The agent modifies configuration to add a malicious command as an MCP server and enable it (adding to enabledMcpServers, removing from disabledMcpServers), or overwrites the Visual Studio ripgrepPath setting with an arbitrary binary path.^[0]
5. Execution: The IDE launches the attacker-configured MCP server command, or executes the substituted ripgrep binary when Copilot performs a search, achieving arbitrary command execution — the proof of concept pops calc.exe.^[0]

Disclosure timeline

How it works

In Windows, a filename ending with the ASCII period (0x2E) is valid at the NTFS layer but the Win32 layer ignores the trailing dot, so `settings.json` and `settings.json.` typically resolve to the same file. Microsoft documents this behavior explicitly.^[0][2]

The protection logic in EditsFunctionHandler.GetEditConfirmationTypeAsync compares the target filename against protected names using string comparison. Supplying `.mcp.json.` instead of `.mcp.json` passes the check because the two strings differ, yet the subsequent write via standard Windows file APIs strips the trailing dot and targets the protected `.mcp.json` file — defeating the guard.^[0]

Additional discovered bypasses include path-traversal: paths starting inside the trusted Extensions directory can contain `..\` components that resolve outside the allowed directory, permitting reads of SSMS.isolation.ini and the user's settings file without the expected confirmation. SSMS.isolation.ini discloses the InstallationID needed to locate the writable per-install settings.json.^[0]

Microsoft's fix added a call to GetFullPath, which on Windows removes trailing dots and resolves relative path components such as `..`, addressing the trailing-dot bypass and some path-traversal variants.^[0]

Affected versions and patch status

Key takeaways

• A single trailing dot was sufficient to bypass a protected-filename security check, highlighting the risk of string-comparison validation against filenames that Windows later canonicalizes differently.^[0]
• AI coding agents expand the attack surface: indirect prompt injection can hijack a model (here MAI-Code-1-Flash, noted for poor injection resilience) to abuse filesystem canonicalization bugs and escape containment into arbitrary command execution.^[0]
• Security controls around agents must remain effective even when the agent itself is compromised — an assume-breach, trust-no-AI posture.^[0]

Defensive actions

• Apply the Microsoft patch for CVE-2026-103572 to all Visual Studio and SSMS installations.: The October 13, 2026 fix adds GetFullPath normalization that closes the trailing-dot and some path-traversal bypasses enabling agent containment escape and RCE.^[0][1]
• Treat agent containment and security controls as defenses that must hold even when the AI agent is compromised or misaligned.: The researcher stresses that security controls around agents must hold under an assume-breach model, as indirect prompt injection can hijack the agent to abuse file-write protections.^[0]